Loading story…
SBA Research disclosed CVE-2026-42547, an incorrect authorization flaw in DFIR-IRIS that affects versions up to 2.4.27 and allows users with alert creation or alert-writing privileges to falsely attribute alerts to customers they are not assigned to. Researchers found that a user could create an alert for an authorized customer and then modify the alert_customer_id during an update, bypassing intended tenant boundaries because the application did not properly validate authorization on security-sensitive alert properties.
The flaw was fixed in DFIR-IRIS 2.4.28, and the advisory urges organizations to upgrade immediately and enforce authorization checks on alert updates. SBA Research said the issue could also be chained with cross-site scripting to trick privileged users into reassigning alerts, potentially enabling unauthorized access to or exfiltration of alerts belonging to other customers; the issue was published after unsuccessful attempts to contact the vendor.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
SBA Research's GitHub advisory made public technical details of the DFIR-IRIS flaw, including the alert_customer_id manipulation path and the note that vendor contact attempts were unsuccessful. The repository states the issue was publicly disclosed on this date.
SBA Research disclosed a medium-severity incorrect authorization vulnerability in DFIR-IRIS, tracked as CVE-2026-42547. The advisory described how attackers could falsify alert attribution across customers and potentially combine the issue with cross-site scripting to exfiltrate unauthorized alerts.
DFIR-IRIS remediated CVE-2026-42547 in version 2.4.28. The flaw affected versions up to 2.4.27 and allowed users with alert-writing privileges to create or reassign alerts to customers not assigned to them.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SBA Research disclosed **CVE-2026-42540**, a medium-severity mass assignment vulnerability in **DFIR-IRIS** that affects versions up to and including `2.4.27`. The flaw allows authenticated users, including administrators, to manipulate API requests and change backend fields that are not meant to be editable through the GUI, exposing sensitive attributes such as asset type IDs, user UUIDs, usernames, account type, account active status, MFA secrets, and MFA activation state. The issue was traced to request data being loaded without strict field allowlisting across multiple endpoints, including asset type add/update functions and user update functionality. The advisory says some unauthorized changes are stopped only by database constraints rather than by application-layer validation, showing that the software still attempts prohibited updates. SBA Research said the bug was fixed in **DFIR-IRIS `2.4.28`** and urged users to upgrade, while also recommending strict allowlists or Data Transfer Objects to limit writable fields. The researchers added that the weakness appears systemic rather than isolated, noting an earlier related flaw, **CVE-2026-22783**, as evidence that mass assignment issues had not been comprehensively remediated across the codebase.
Jun 29, 2026
SBA Research publicly disclosed four vulnerabilities affecting **DFIR-IRIS 2.4.26** and possibly other versions, including three stored cross-site scripting flaws—`CVE-2026-16969`, `CVE-2026-18360`, and `CVE-2026-18361`—and an insufficient logout implementation tracked as `CVE-2026-16970`. The stored XSS issues affect the **assets**, **custom attributes**, and **datastore upload** functions, allowing attacker-supplied JavaScript to run in a victim's browser. If an administrator is targeted, the impact could extend to session hijacking or broader application compromise. The XSS issues were assigned a **CVSS 3.1 score of 7.6**, while the logout flaw received a **4.2** rating. The logout weakness leaves a stolen session cookie valid after a user signs out because the application removes the cookie only on the client side and does not invalidate the session server-side, enabling continued access to protected resources. At the time of disclosure, **no fix was available**, and SBA Research said repeated attempts to contact the vendor were unsuccessful before publishing the advisories. Recommended mitigations include stronger output encoding, safer templating practices, serving uploaded SVG files as attachments, tightening the Content Security Policy by removing `unsafe-inline`, and ensuring server-side session invalidation on logout.
Jul 30, 2026
Researchers disclosed **CVE-2025-25256**, a pre-authentication command injection vulnerability in **Fortinet FortiSIEM** that could allow an unauthenticated attacker to execute commands on exposed systems without logging in first. The issue was detailed by watchTowr Labs and echoed by Summoning Team, both highlighting the risk posed by a flaw in a security monitoring product that is often deployed with broad visibility into enterprise environments. The available reporting identifies the bug as a **pre-auth** attack path with potential for remote exploitation, but the supplied references do not include affected version details, confirmed in-the-wild abuse, or vendor remediation guidance. Even with those gaps, the disclosure raises urgent concern because successful exploitation of a SIEM platform could give attackers a foothold in a high-value security appliance and access to sensitive operational data.
Aug 1, 2026