The vulnerability in dfir-iris iris-web (up to version 2.4.29) arises from failure to properly validate case authorization when listing comments associated with various case objects such as notes, tasks, IOCs, assets, and evidence items. An attacker with access to one case can exploit this by enumerating sequential object identifiers to access comment threads from other cases they are not authorized to view. This leads to unauthorized disclosure of potentially sensitive information contained in those comment threads. The CVSS 4.0 score is 7.1 (high), reflecting network attack vector, low attack complexity, no privileges required beyond access to a single case, no user interaction, and high impact on confidentiality.

Successful exploitation allows an attacker with limited access (to a single case) to bypass authorization controls and read comment threads from other cases. This results in unauthorized disclosure of sensitive case information, potentially compromising confidentiality of investigations or evidence managed within the iris-web application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the iris-web application to trusted users only and monitor for unusual access patterns. Avoid exposing the application to untrusted networks. Follow vendor updates closely for an official patch or workaround.