CVE-2026-92605 in iris-web
Summary
by MITRE • 09/17/2026
IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to access.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in IRIS versions through 2.4.29 represents a critical failure in the implementation of Access Control, specifically falling under the category of Broken Access Control as defined by CWE-639. This flaw manifests within the application's comment listing endpoints for various data types including notes, tasks, Indicators of Compromise (IOCs), assets, and evidence items. The core technical issue lies in the server-side logic which fails to properly validate case authorization when processing requests to retrieve comments associated with specific objects. Instead of verifying that the authenticated user possesses explicit permissions for the target case or object, the system relies on a flawed mechanism that allows access based solely on the existence of an identifier within a sequential range.
From a technical perspective, this vulnerability enables attackers who have valid credentials and access to at least one single case to perform unauthorized enumeration of sequential object identifiers. By iterating through these predictable IDs, an attacker can systematically request comment threads for objects belonging to cases they are not authorized to view or interact with. This behavior is characteristic of Insecure Direct Object References (IDOR), categorized under CWE-200 and often associated with the ATT&CK technique T1539 which involves stealing web session cookies but in this context, it facilitates unauthorized data access through identifier manipulation rather than credential theft alone. The predictability of these identifiers significantly lowers the barrier for exploitation, allowing automated scripts to rapidly scan large portions of the database without triggering typical anomaly detection systems that look for random or non-sequential access patterns.
The operational impact of this vulnerability is severe, particularly in environments where IRIS is used as a central platform for incident response and threat intelligence operations. Since comment threads often contain sensitive contextual information, analyst notes, and potentially confidential details about ongoing investigations, the ability to read these comments without authorization constitutes a significant data exfiltration risk. Attackers can gain insights into active security incidents, internal methodologies, and strategic decisions made by security teams. Furthermore, because this affects multiple object types including IOCs and evidence items, it compromises not only confidentiality but also the integrity of the threat intelligence lifecycle by exposing raw data that should be restricted to authorized personnel. This exposure could lead to competitive disadvantage if proprietary threat data is leaked or provide adversaries with valuable reconnaissance on an organization's security posture and response capabilities.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution involves upgrading IRIS to a version later than 2.4.29 where this authorization check has been corrected by the vendor. For organizations unable to upgrade immediately, implementing strict input validation on all object identifiers is necessary, ensuring that every request for comment data includes a server-side verification of the user's role and permissions relative to the specific case ID requested. Additionally, replacing sequential integer-based identifiers with non-sequential Universally Unique Identifiers (UUIDs) can mitigate enumeration attacks by removing predictability from the identifier space. Security teams should also audit their access control policies to ensure that authorization checks are enforced at every endpoint level rather than relying on higher-level application logic which may be bypassed through direct API calls. Regular penetration testing focusing on broken object level permissions is recommended to identify similar flaws in other parts of the application infrastructure.