# CVE-2026-42539: DFIR-IRIS IRIS excessive data exposure in API responses

Source: https://junglewise.ai/threats/cve-2026-42539-dfir-iris-iris-excessive-data-exposure-in-api-responses  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-42539 · Severity: medium · CVSS 6.5 · Published 2026-06-04

IRIS is a collaborative platform used by incident responders to manage and share technical details during security investigations. A vulnerability in the platform's API allows authenticated users to view sensitive information that should be hidden, such as password hashes, multi-factor authentication (MFA) secrets, and internal server file paths. This exposure could allow a malicious user to compromise other accounts or gain deeper access to the server hosting the platform.

Technologies: [DFIR-IRIS Iris](https://junglewise.ai/threats/technologies/iris). Vendors: [DFIR-IRIS](https://junglewise.ai/threats/vendors/dfir-iris).

## Quick answers

**Is CVE-2026-42539 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42539 being exploited in the wild.

**How severe is CVE-2026-42539?** Medium severity, with a CVSS score of 6.5, published 4 June 2026.

**Which products and versions are affected?** DFIR-IRIS Iris <= 2.4.27.

**Is there a fix for CVE-2026-42539?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42539 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42539?** Check whether you run DFIR-IRIS Iris at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An excessive data exposure vulnerability (CWE-201) exists in the IRIS web application API. When certain objects are accessed or updated via the API, the server returns JSON responses containing sensitive fields that are not required for client-side operations. Specifically, the `/manage/users/update/` and `/user/update` endpoints leak bcrypt password hashes and MFA secrets, while the Datastore file update endpoint leaks full local server storage paths. An attacker with low-privileged network access can exploit this to obtain credentials or reconnaissance data. The issue is fixed in version 2.4.28 by filtering these fields from API responses.

## Affected products

- DFIR-IRIS IRIS <= 2.4.27

## Timeline

- 2026-01-26: other: Vulnerability discovered by SBA Research
- 2026-05-19: disclosed: Public disclosure on oss-security mailing list
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-06-04: advisory: NVD record published

## References

- [https://github.com/dfir-iris/iris-web/security/advisories/GHSA-g588-5gmf-p5cx](https://github.com/dfir-iris/iris-web/security/advisories/GHSA-g588-5gmf-p5cx)
- [http://www.openwall.com/lists/oss-security/2026/05/19/9](http://www.openwall.com/lists/oss-security/2026/05/19/9)

## Related threats

- [IRIS unauthorized comment enumeration via case access](https://junglewise.ai/threats/cve-2026-92605-iris-unauthorized-comment-enumeration-via-case-access)
- [DFIR-IRIS IRIS Web Stored XSS in datastore upload function](https://junglewise.ai/threats/cve-2026-18361-dfir-iris-iris-web-stored-xss-in-datastore-upload-function)
- [DFIR-IRIS IRIS Web insufficient session expiration in logout function](https://junglewise.ai/threats/cve-2026-16970-dfir-iris-iris-web-insufficient-session-expiration-in-logout)
- [DFIR-IRIS IRIS Web Stored XSS in assets function](https://junglewise.ai/threats/cve-2026-16969-dfir-iris-iris-web-stored-xss-in-assets-function)
- [DFIR-IRIS IRIS incorrect authorization in alert management](https://junglewise.ai/threats/cve-2026-42547-dfir-iris-iris-incorrect-authorization-in-alert-management)