CVE-2026-42539 — IRIS has an Excessive Data Exposure issue

CVE-2026-42539

IRIS has an Excessive Data Exposure issue PUBLISHED

Description (CNA)

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.

Affected (CNA)

Vendor / product	Versions
dfir-iris / iris-web	affected < 2.4.28

CWE

CWE-201

References

https://github.com/dfir-iris/iris-web/security/advisories/GHSA-g588-5gmf-p5cx

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/05/19/9

CISA-ADP

No English description supplied.

https://github.com/dfir-iris/iris-web/security/advisories/GHSA-g588-5gmf-p5cx