CVE-2026-42543: IRIS CSRF Vulnerability – Patch to 2.4.28

Technical summary

The vulnerability (CVE-2026-42543) is classified as CWE-650 (Insecure Direct Object References and State-Change Requests via GET). IRIS versions before 2.4.28 fail to enforce the fundamental web security principle of using POST, PUT, or DELETE methods for operations that change server state. Instead, state-modifying actions are performed via GET requests, which are trivial to trigger via cross-site means. This allows an unauthenticated attacker to craft a request that, when executed in the browser context of an authenticated IRIS user, results in unauthorized state changes. The CVSS 3.1 score of 4.3 (MEDIUM) reflects limited impact—integrity is compromised but confidentiality and availability are not directly affected—and the requirement for user interaction (visiting a malicious link).

Business impact

The integrity of incident response investigations could be compromised if attackers manipulate case data, modify findings, or alter collaboration artifacts without proper authorization trails. For security teams relying on IRIS to coordinate breach investigations or forensic activities, unauthorized state changes could introduce confusion, obscure the true timeline of events, or lead to incorrect conclusions. While direct data exfiltration is not a concern, the reputational and operational risk of corrupted investigation records is material, particularly in regulated environments requiring audit trails and evidence integrity.

Affected systems

IRIS versions prior to 2.4.28 are vulnerable. Version 2.4.28 and later contain the patch. Organizations running earlier versions, especially those deployed as central collaboration hubs for incident response, are at risk. The vulnerability does not require network proximity or special privileges to exploit—any web-accessible IRIS instance is a potential target if users can be socially engineered or exposed to attacker-controlled content.

Exploitability

Exploitability is moderate. The attack requires user interaction (the target must click a link or visit a malicious website while authenticated to IRIS), which reduces the likelihood of large-scale automated exploitation. However, social engineering is straightforward, and incident responders may be more likely than typical users to follow links from seemingly trusted sources during active investigations. The attack leaves minimal forensic evidence if not carefully logged, and there is no requirement for authentication bypass or complex technical manipulation—only abuse of the insecure GET-based state changes.

Remediation

Upgrade IRIS to version 2.4.28 or later immediately. Version 2.4.28 contains the necessary patch to enforce proper HTTP methods for state-changing operations. Organizations unable to upgrade immediately should implement compensating controls, such as Content Security Policy (CSP) headers to restrict cross-origin requests, or educate users to avoid clicking untrusted links while authenticated. Verify compatibility with your deployment before upgrading.

Patch guidance

Deploy version 2.4.28 or later. Before upgrading in production, test the patch in a non-production environment to confirm functionality and compatibility with any custom integrations or plugins. Review the IRIS release notes for version 2.4.28 to understand any configuration changes or deprecations. Once deployed, confirm that state-changing actions now use appropriate HTTP methods (POST, PUT, DELETE) rather than GET.

Detection guidance

Monitor web server and application logs for suspicious patterns: repeated GET requests from external origins targeting state-change endpoints, unusual referrer headers, or GET requests containing action parameters (e.g., 'action=delete' or 'action=modify'). Implement logging of all state-change operations with user identity and HTTP method. Review IRIS audit logs for unexplained changes to case data, findings, or user permissions. If possible, correlate authentication timestamps with state-change events to identify requests executed outside normal user behavior patterns.

Why prioritize this

This vulnerability should be prioritized for patching in the next maintenance window, but not emergency escalation. The CVSS score of 4.3 (MEDIUM) and lack of KEV designation reflect the requirement for user interaction and limited scope of compromise. However, the nature of IRIS as a central incident response collaboration platform means that compromised data integrity could have downstream investigation impacts. Organizations relying heavily on IRIS for critical incident coordination should patch sooner; those with lighter usage may consolidate patching with standard update cycles.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) accounts for: network accessibility (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and user interaction needed (UI:R). Impact is confined to integrity (I:L) with no confidentiality or availability loss. The score appropriately reflects that while the vulnerability is easy to exploit, the damage is limited to unauthorized state changes rather than data breach or system outage. Organizations with strict change control and audit logging may experience lower real-world risk than the base score suggests.

Frequently asked questions