Executive brief
IRIS is a collaborative platform used by incident responders to share and manage technical details during security investigations. A vulnerability in the platform's API allows authenticated users to modify sensitive database values that should be restricted, such as user account types, MFA settings, and internal object IDs. This could allow a user to escalate their privileges, disable security features like multi-factor authentication, or disrupt the integrity of investigation data.
Technical details
A mass assignment vulnerability (CWE-915) exists in IRIS versions prior to 2.4.28. The application's API endpoints for write operations, such as asset type updates, fail to filter sensitive parameters from user-supplied input before binding them to database models. An authenticated attacker can send specially crafted API requests containing additional parameters not exposed in the GUI to modify restricted fields. Impacted data points include Object IDs, account types (e.g., converting a regular account to a ServiceAccount), MFA secrets, and account activation status. The vulnerability is patched in version 2.4.28.
Affected products
- DFIR-IRIS IRIS <= 2.4.27
Timeline
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-06-04: disclosed: CVE published to NVD