Executive brief
IRIS, a web platform used by incident responders to manage security investigations, contains a vulnerability that allows users to create or reassign alerts to customers they are not authorized to manage. This could allow a malicious user to inject fake security alerts into another customer's dashboard or, if combined with other web attacks, potentially view sensitive alert data belonging to other organizations. Such activity could lead to misinformation during investigations or the exposure of confidential incident details.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the IRIS alert management API. While the platform requires users to have 'alerts_write' privileges and a specific customer assignment to create an initial alert, the update API (/alerts/update/<id>) fails to validate security-relevant properties like 'alert_customer_id'. An authenticated attacker with basic alert permissions can modify an existing alert's customer ID to reassign it to a customer they do not own. This bypasses intended access controls and, when combined with Cross-Site Scripting (XSS), can be used to exfiltrate alert data from other customers. The issue is fixed in version 2.4.28 by implementing server-side validation of updated properties.
Affected products
- DFIR-IRIS IRIS < 2.4.28
Timeline
- 2026-01-28: other: Vulnerability identified in version 2.4.26
- 2026-04-27: patched: Version 2.4.28 released with fix
- 2026-05-28: advisory: GitHub security advisory published
- 2026-06-04: disclosed: CVE published to NVD