CVE-2026-42543
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 are vulnerable to a cross-site request forgery attack, because they use the HTTP method `GET` to change state on the server. Version 2.4.28 contains a patch.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- EPSS probability
- 0.17%
- CWE
- CWE-650
- Published
- 2026-06-04
- Last modified
- 2026-06-08
Affected products
- dfir-iris iris-web
Weakness type
Related vulnerabilities
- CVE-2026-15753 — zhinianboke xianyu-auto-reply review approve trusting http permission methods on the server side
- CVE-2026-44548 — ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)
- CVE-2024-56339 — IBM WebSphere Application Server information disclosure
- CVE-2025-21120 — Dell Avamar, versions prior to 19.10 SP1 with patch 338904, contains a Trusting HTTP Permission...
- CVE-2024-45282 — HTTP Verb Tampering in SAP S/4 HANA(Manage Bank Statements)
- CVE-2024-45097 — IBM Aspera Faspex bypass security
- CVE-2024-45098 — IBM Aspera Faspex bypass security
- CVE-2024-28787 — IBM Security Verify Access information disclosure