CVE-2026-42539CWE-201

IRIS has an Excessive Data Exposure issue

Medium · published June 4, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
31.4
In the wild
Unconfirmed
What it is

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00386 · 31.4th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2026-06-04T20:54Z
EPSS history
Timeline
  • 04 JUN 20:54Z
    IRIS has an Excessive Data Exposure issue
    cvelistv5