Is CVE-2026-42547 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42547 being exploited in the wild.

How severe is CVE-2026-42547?

Medium severity, with a CVSS score of 5.4, published 4 June 2026.

Is there a fix for CVE-2026-42547?

A patch was published on 2026-04-27: Version 2.4.28 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42547 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-42547?

Check whether you run DFIR-IRIS Iris at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42547: DFIR-IRIS IRIS incorrect authorization in alert management

CVE-2026-42547 · Severity: medium · CVSS 5.4 · Published 2026-06-04

IRIS, a web platform used by incident responders to manage security investigations, contains a vulnerability that allows users to create or reassign alerts to customers they are not authorized to manage. This could allow a malicious user to inject fake security alerts into another customer's dashboard or, if combined with other web attacks, potentially view sensitive alert data belonging to other organizations. Such activity could lead to misinformation during investigations or the exposure of confidential incident details.

Technologies: DFIR-IRIS Iris. Vendors: DFIR-IRIS.

Quick answers

Is CVE-2026-42547 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42547 being exploited in the wild.
How severe is CVE-2026-42547?: Medium severity, with a CVSS score of 5.4, published 4 June 2026.
Which products and versions are affected?: DFIR-IRIS Iris < 2.4.28.
Is there a fix for CVE-2026-42547?: A patch was published on 2026-04-27: Version 2.4.28 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42547 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-42547?: Check whether you run DFIR-IRIS Iris at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in the IRIS alert management API. While the platform requires users to have 'alerts_write' privileges and a specific customer assignment to create an initial alert, the update API (/alerts/update/<id>) fails to validate security-relevant properties like 'alert_customer_id'. An authenticated attacker with basic alert permissions can modify an existing alert's customer ID to reassign it to a customer they do not own. This bypasses intended access controls and, when combined with Cross-Site Scripting (XSS), can be used to exfiltrate alert data from other customers. The issue is fixed in version 2.4.28 by implementing server-side validation of updated properties.

Affected products

DFIR-IRIS IRIS < 2.4.28

Timeline

2026-01-28: other: Vulnerability identified in version 2.4.26
2026-04-27: patched: Version 2.4.28 released with fix
2026-05-28: advisory: GitHub security advisory published
2026-06-04: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.