# CVE-2026-42547: DFIR-IRIS IRIS incorrect authorization in alert management

Source: https://junglewise.ai/threats/cve-2026-42547-dfir-iris-iris-incorrect-authorization-in-alert-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-42547 · Severity: medium · CVSS 5.4 · Published 2026-06-04

IRIS, a web platform used by incident responders to manage security investigations, contains a vulnerability that allows users to create or reassign alerts to customers they are not authorized to manage. This could allow a malicious user to inject fake security alerts into another customer's dashboard or, if combined with other web attacks, potentially view sensitive alert data belonging to other organizations. Such activity could lead to misinformation during investigations or the exposure of confidential incident details.

Technologies: [DFIR-IRIS Iris](https://junglewise.ai/threats/technologies/iris). Vendors: [DFIR-IRIS](https://junglewise.ai/threats/vendors/dfir-iris).

## Quick answers

**Is CVE-2026-42547 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42547 being exploited in the wild.

**How severe is CVE-2026-42547?** Medium severity, with a CVSS score of 5.4, published 4 June 2026.

**Which products and versions are affected?** DFIR-IRIS Iris < 2.4.28.

**Is there a fix for CVE-2026-42547?** A patch was published on 2026-04-27: Version 2.4.28 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42547 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-42547?** Check whether you run DFIR-IRIS Iris at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability (CWE-863) exists in the IRIS alert management API. While the platform requires users to have 'alerts_write' privileges and a specific customer assignment to create an initial alert, the update API (/alerts/update/<id>) fails to validate security-relevant properties like 'alert_customer_id'. An authenticated attacker with basic alert permissions can modify an existing alert's customer ID to reassign it to a customer they do not own. This bypasses intended access controls and, when combined with Cross-Site Scripting (XSS), can be used to exfiltrate alert data from other customers. The issue is fixed in version 2.4.28 by implementing server-side validation of updated properties.

## Affected products

- DFIR-IRIS IRIS < 2.4.28

## Timeline

- 2026-01-28: other: Vulnerability identified in version 2.4.26
- 2026-04-27: patched: Version 2.4.28 released with fix
- 2026-05-28: advisory: GitHub security advisory published
- 2026-06-04: disclosed: CVE published to NVD

## References

- [https://github.com/dfir-iris/iris-web/security/advisories/GHSA-8hwq-v6vm-9grr](https://github.com/dfir-iris/iris-web/security/advisories/GHSA-8hwq-v6vm-9grr)
- [http://www.openwall.com/lists/oss-security/2026/05/19/12](http://www.openwall.com/lists/oss-security/2026/05/19/12)

## Related threats

- [IRIS unauthorized comment enumeration via case access](https://junglewise.ai/threats/cve-2026-92605-iris-unauthorized-comment-enumeration-via-case-access)
- [DFIR-IRIS IRIS Web Stored XSS in datastore upload function](https://junglewise.ai/threats/cve-2026-18361-dfir-iris-iris-web-stored-xss-in-datastore-upload-function)
- [DFIR-IRIS IRIS Web insufficient session expiration in logout function](https://junglewise.ai/threats/cve-2026-16970-dfir-iris-iris-web-insufficient-session-expiration-in-logout)
- [DFIR-IRIS IRIS Web Stored XSS in assets function](https://junglewise.ai/threats/cve-2026-16969-dfir-iris-iris-web-stored-xss-in-assets-function)
- [DFIR-IRIS IRIS CSRF via HTTP GET in state-changing endpoints](https://junglewise.ai/threats/cve-2026-42543-dfir-iris-iris-csrf-via-http-get-in-state-changing-endpoints)