CVE-2026-92605: IRIS through 2.4.29 Unauthorized Comment Access via Object ID

Q: Who can exploit this issue?

An attacker needs access to at least one IRIS case. From that foothold, they can enumerate sequential object IDs and retrieve comment threads associated with cases they are not authorized to access.

Q: What information is exposed?

The affected comment-listing endpoints can expose comment threads for notes, tasks, IOCs, assets, and evidence items in unauthorized cases. The reported impact is confidentiality loss; integrity and availability impacts are not indicated.

Q: Which versions are affected?

IRIS through version 2.4.29 is affected.

Published Sep 16, 2026

Updated

IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to access.

Affected Software

1 affected component

IRIS<=2.4.29

Event History

Sep 16, 2026

CVE Published

via MITRE·05:31 PM

Data Sourced

via MITRE·05:31 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs access to at least one IRIS case. From that foothold, they can enumerate sequential object IDs and retrieve comment threads associated with cases they are not authorized to access.

What information is exposed?

The affected comment-listing endpoints can expose comment threads for notes, tasks, IOCs, assets, and evidence items in unauthorized cases. The reported impact is confidentiality loss; integrity and availability impacts are not indicated.

Which versions are affected?