Loading story…
SBA Research disclosed CVE-2026-42540, a medium-severity mass assignment vulnerability in DFIR-IRIS that affects versions up to and including 2.4.27. The flaw allows authenticated users, including administrators, to manipulate API requests and change backend fields that are not meant to be editable through the GUI, exposing sensitive attributes such as asset type IDs, user UUIDs, usernames, account type, account active status, MFA secrets, and MFA activation state. The issue was traced to request data being loaded without strict field allowlisting across multiple endpoints, including asset type add/update functions and user update functionality.
The advisory says some unauthorized changes are stopped only by database constraints rather than by application-layer validation, showing that the software still attempts prohibited updates. SBA Research said the bug was fixed in DFIR-IRIS 2.4.28 and urged users to upgrade, while also recommending strict allowlists or Data Transfer Objects to limit writable fields. The researchers added that the weakness appears systemic rather than isolated, noting an earlier related flaw, CVE-2026-22783, as evidence that mass assignment issues had not been comprehensively remediated across the codebase.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
SBA Research published an advisory for CVE-2026-42540, describing a medium-severity mass assignment issue in DFIR-IRIS across multiple API endpoints. The disclosure included exploitation details, impacted fields such as MFA secrets and account attributes, and recommended upgrading to 2.4.28 or later.
DFIR-IRIS addressed a mass assignment vulnerability, later tracked as CVE-2026-42540, in release 2.4.28. The flaw affected versions up to and including 2.4.27 and allowed authenticated users to modify backend fields through crafted API requests.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SBA Research disclosed **CVE-2026-42547**, an incorrect authorization flaw in **DFIR-IRIS** that affects versions up to `2.4.27` and allows users with alert creation or alert-writing privileges to falsely attribute alerts to customers they are not assigned to. Researchers found that a user could create an alert for an authorized customer and then modify the `alert_customer_id` during an update, bypassing intended tenant boundaries because the application did not properly validate authorization on security-sensitive alert properties. The flaw was fixed in **DFIR-IRIS `2.4.28`**, and the advisory urges organizations to upgrade immediately and enforce authorization checks on alert updates. SBA Research said the issue could also be chained with **cross-site scripting** to trick privileged users into reassigning alerts, potentially enabling unauthorized access to or exfiltration of alerts belonging to other customers; the issue was published after unsuccessful attempts to contact the vendor.
Jun 29, 2026
SBA Research publicly disclosed four vulnerabilities affecting **DFIR-IRIS 2.4.26** and possibly other versions, including three stored cross-site scripting flaws—`CVE-2026-16969`, `CVE-2026-18360`, and `CVE-2026-18361`—and an insufficient logout implementation tracked as `CVE-2026-16970`. The stored XSS issues affect the **assets**, **custom attributes**, and **datastore upload** functions, allowing attacker-supplied JavaScript to run in a victim's browser. If an administrator is targeted, the impact could extend to session hijacking or broader application compromise. The XSS issues were assigned a **CVSS 3.1 score of 7.6**, while the logout flaw received a **4.2** rating. The logout weakness leaves a stolen session cookie valid after a user signs out because the application removes the cookie only on the client side and does not invalidate the session server-side, enabling continued access to protected resources. At the time of disclosure, **no fix was available**, and SBA Research said repeated attempts to contact the vendor were unsuccessful before publishing the advisories. Recommended mitigations include stronger output encoding, safer templating practices, serving uploaded SVG files as attachments, tightening the Content Security Policy by removing `unsafe-inline`, and ensuring server-side session invalidation on logout.
Jul 30, 2026
The Canadian Centre for Cyber Security warned that **MISP CTI-Transmute** versions `<= 1.4.0` are affected by multiple vulnerabilities, including **CVE-2026-69082** and **CVE-2026-69079`. One flaw allows **cross-site request forgery (CSRF)** against the administrative user-deletion endpoint because `/account/delete/<id>` accepted HTTP `GET` requests for a state-changing action, letting an attacker trick a logged-in administrator into deleting a chosen user account. The issue could cause unauthorized state changes, denial of access for affected users, and potential disruption if administrator accounts are targeted. A second high-severity flaw allows **unauthenticated denial of service** through the `/activity_timeline` endpoint, where an unbounded `days` parameter could be abused to force excessive database, CPU, and memory consumption and degrade site availability. The advisory also referenced remediation for blocking file and network fetches during evaluation PDF rendering, alongside fixes that cap the timeline range and require `POST` plus CSRF protection for user deletion. Administrators were urged to review the linked fixes and apply updates as they become available.
Aug 4, 2026