CVE-2026-92605: IRIS Authentication Bypass Vulnerability

CVE-2026-92605 Overview

CVE-2026-92605 is an Insecure Direct Object Reference (IDOR) vulnerability in DFIR-IRIS, the open-source incident response platform. Versions through 2.4.29 fail to validate case authorization on comment listing endpoints for notes, tasks, indicators of compromise (IOCs), assets, and evidence items. An authenticated user with access to any single case can enumerate sequential object identifiers and read comment threads from cases they are not authorized to view. The flaw is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated IRIS user can retrieve sensitive investigation commentary — including analyst notes on ongoing incidents — from unrelated cases by iterating numeric object IDs.

Affected Products

DFIR-IRIS iris-web versions up to and including 2.4.29
Comment listing endpoints for notes, tasks, IOCs, assets, and evidence items
Deployments of IRIS used as a multi-tenant or multi-team DFIR case management system

Discovery Timeline

2026-09-16 - CVE-2026-92605 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92605

Vulnerability Analysis

DFIR-IRIS enforces case-scoped access control across most of its blueprints, requiring that a user be a member of a case before reading its data. The comment listing routes for notes, tasks, IOCs, assets, and evidence items break this pattern. According to the VulnCheck advisory, these endpoints accept an object identifier from the URL and return the associated comments without confirming that the object belongs to a case the caller can access.

Because IRIS assigns sequential integer identifiers to notes, tasks, IOCs, assets, and evidence items, an attacker with a valid session and access to any case can iterate identifiers starting from 1 and harvest comments across the entire deployment. This exposes analyst discussions, attribution notes, containment decisions, and other sensitive investigation content.

Root Cause

The vulnerability stems from missing authorization checks in the comment retrieval logic. The route handler in case_notes_routes.py and the underlying data layer in case_comments.py query comments by object ID directly. Neither layer joins against the current user's case membership or verifies that the requested object resides within an authorized case, matching the classic [CWE-639] pattern.

Attack Vector

Exploitation requires only low-privileged authenticated access over the network. An attacker logs into IRIS with any valid account, then issues sequential HTTP requests to the vulnerable comment endpoints, incrementing the trailing numeric identifier. Each response returns comment threads for the referenced object regardless of case ownership. No user interaction, elevated privileges, or specialized tooling is required. See the VulnCheck advisory and technical write-up for endpoint details.

Detection Methods for CVE-2026-92605

Indicators of Compromise

Sequential enumeration patterns in web server logs targeting /case/notes/, /case/tasks/, /case/ioc/, /case/assets/, or /case/evidences/ comment sub-paths.
A single authenticated session issuing many comment listing requests within a short interval across non-contiguous case IDs.
Access to object identifiers that do not belong to any case the user is a member of, visible when correlating IRIS access logs with case membership tables.

Detection Strategies

Instrument the IRIS reverse proxy or WSGI layer to log the authenticated user ID, requested object ID, and owning case ID for every comment endpoint call.
Alert when a user retrieves comments from a case they are not assigned to, using database joins between session logs and the cases_users membership table.
Baseline normal comment-read volume per user and flag statistical outliers indicative of enumeration.

Monitoring Recommendations

Forward IRIS application and reverse proxy logs to a centralized analytics platform for retention and correlation.
Track HTTP 200 responses to comment endpoints where the response body contains data for cases outside the requester's assignments.
Monitor for scripted user agents or unusually rapid request cadence against IRIS API paths.

How to Mitigate CVE-2026-92605

Immediate Actions Required

Restrict network access to IRIS instances to trusted analyst networks or a VPN until a patched release is deployed.
Audit existing user accounts and disable inactive or shared credentials that could be abused to trigger the IDOR.
Review historical access logs for enumeration patterns against the affected comment endpoints and rotate any secrets or attribution details that may have been exposed in comments.

Patch Information

At the time of publication, the DFIR-IRIS project repository has not published a fixed release beyond 2.4.29. Monitor the upstream repository and the VulnCheck advisory for a patched version, and upgrade as soon as it becomes available. Any fix must add case-membership validation in both the route handler and the get_case_comments data-access function.

Workarounds

Limit IRIS accounts to trusted incident responders and remove access for users who do not require the platform.
Deploy a reverse proxy rule that requires the referring case ID to match the object being requested on comment endpoints, dropping requests that cannot be validated.
Avoid placing highly sensitive attribution, credential, or victim information in case comments until the deployment is patched.

bash

# Example NGINX rule restricting IRIS to a trusted analyst subnet
location /case/ {
    allow 10.20.30.0/24;   # analyst VLAN
    deny  all;
    proxy_pass http://iris_backend;
}