CVE-2026-92605

IRIS, an open-source incident-response case-management platform, fails through version 2.4.29 to enforce case-level authorization on the comment-listing endpoints for notes, tasks, IOCs, assets, and evidence items (CWE-639, broken object-level authorization). An authenticated user who has legitimate access to any single case can iterate over sequential object identifiers and retrieve comment threads from cases they are not authorized to see, on the same instance. The impact is confidentiality-only (high), but the data exposed can include sensitive investigation details from other clients' or other teams' cases, and the attack requires only a low-privileged account via the network with no user interaction (CVSS 4.0 score 7.1, high). All deployments of IRIS up to and including 2.4.29 are affected, which in practice means self-hosted instances operated by CERTs, CSIRTs, and security teams. No exploitation in the wild, KEV listing, or public proof-of-concept is currently known.

What to do: Upgrade to the latest IRIS release (anything beyond 2.4.29, i.e., the first patched build once published) as the primary fix, since no vendor-side mitigation short of patching is described. In the meantime, restrict case membership to vetted staff, limit API access to trusted accounts, and review access logs for authenticated users requesting comment endpoints across many sequential object IDs, which would indicate enumeration. Note that no fix version is confirmed in the available data, so verify the vendor's advisory for the patched release.