CVE-2026-41522

HighCVSS 7.1

Published: 04/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Iris (DFIR-IRIS) before version 2.4.28 exposes an optional GraphQL endpoint at `/graphql` without proper authorization checks. An authenticated user can read IOCs from other cases (IDOR), disclose all IOCs in a case, and create unauthorized cases.

Risk Assessment

An attacker could access sensitive data (IOCs) from other cases and create unauthorized cases, compromising confidentiality and integrity.

Recommendation

Update DFIR-IRIS to version 2.4.28 or block the `/graphql` endpoint at the reverse proxy.

Other vulnerabilities in DFIR-IRIS

CVE-2026-22783Critical
Vulnerability in DFIR-IRIS (Iris platform) before version 2.4.24: mass assignment of the file_local_name field combined with path trust in the delete operation enables authenticated users to delete arbitrary filesystem paths.

Original NVD description (English source)

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at `/graphql` that does not enforce the same authorization checks as the REST API. Any authenticated user can abuse it in three ways: unauthorized IOC read across cases (IDOR), bulk IOC disclosure via `case.iocs`. The `case(caseId: …).iocs` resolver returns IOCs linked to an arbitrary case without verifying the caller has access to that case, and unauthorized case creation. All three are reachable by any authenticated user, regardless of role or case ACL. This is fixed in v2.4.28. The GraphQL blueprint, resolvers, and dependencies (`graphene`, `graphene-sqlalchemy`, `graphql-server[flask]`) were removed entirely, since the feature was not in use. As a workaround, block `/graphql` at the reverse proxy (recommended) or comment out the `graphql_blueprint` import and `register_blueprint` call in `source/app/views.py` and restart.