CVE-2026-41522 Details
Description
Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at `/graphql` that does not enforce the same authorization checks as the REST API. Any authenticated user can abuse it in three ways: unauthorized IOC read across cases (IDOR), bulk IOC disclosure via `case.iocs`. The `case(caseId: …).iocs` resolver returns IOCs linked to an arbitrary case without verifying the caller has access to that case, and unauthorized case creation. All three are reachable by any authenticated user, regardless of role or case ACL. This is fixed in v2.4.28. The GraphQL blueprint, resolvers, and dependencies (`graphene`, `graphene-sqlalchemy`, `graphql-server[flask]`) were removed entirely, since the feature was not in use. As a workaround, block `/graphql` at the reverse proxy (recommended) or comment out the `graphql_blueprint` import and `register_blueprint` call in `source/app/views.py` and restart.
A vulnerability exists in DFIR-IRIS versions through 2.4.27, where the optional GraphQL endpoint at '/graphql' fails to enforce proper authorization checks, unlike the REST API. This allows any authenticated user to exploit the endpoint in three ways: first, by accessing unauthorized Indicators of Compromise (IOCs) across cases through an Insecure Direct Object Reference (IDOR) vulnerability; second, by disclosing IOCs in bulk via the 'case.iocs' resolver, which does not verify case access; and third, by creating cases without the necessary permissions, bypassing the REST authorization model. These issues can be exploited by any authenticated user, regardless of their role or case access control.
The vulnerability is fixed in DFIR-IRIS version 2.4.28. Users can also block the '/graphql' endpoint at the reverse proxy or comment out the 'graphql_blueprint' import and 'register_blueprint' call in 'source/app/views.py' before restarting the application.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 4, 2026CISA-ADP
Assessed Jun 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dfir-iris/iris-web/security/advisories/GHSA-3mxh-x92q-9r25 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DFIR-IRIS Iris | <= 2.4.27 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | New CVE Received | [email protected] |