CVE-2026-42539 MEDIUM

CVE-2026-42539: IRIS has an Excessive Data Exposure issue

Vendor Dfir-Iris

Product iris-web

Weakness CWE-201

Published June 4, 2026

Last update June 8, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.

Key dates

02Disclosure timeline

June 4, 2026 CVE published

June 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-42539 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/201.html

Related vulnerabilities

04Related CVE

CVE-2025-14823 Certificate Signing Extension Returns Encrypted Values CVE-2024-45653 IBM Sterling Connect:Direct Web Services information disclosure CVE-2026-39542 WordPress Doofinder for WooCommerce plugin <= 2.10.13 - Sensitive Data Exposure vulnerability CVE-2023-1401 Insertion of Sensitive Information Into Sent Data in GitLab CVE-2026-40161 Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL