Executive Summary

CVE-2026-41522 is an improper authorization vulnerability in the DFIR-IRIS application versions 2.4.27 and earlier. It involves an exposed GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API.

This flaw allows any authenticated user to perform unauthorized actions including: reading Indicators of Compromise (IOCs) across cases without permission (IDOR), bulk disclosure of IOCs linked to arbitrary cases, and creating cases without proper authorization.

The vulnerability exists because the GraphQL endpoint fails to verify if the user has access rights to the requested cases, unlike the REST API. The issue was fixed in version 2.4.28 by removing the GraphQL feature entirely.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information, specifically Indicators of Compromise (IOCs) across different cases, which could expose confidential investigation details.

An attacker with any authenticated user privileges can exploit this to read data they should not have access to, potentially compromising the confidentiality of incident response investigations.

Additionally, unauthorized case creation could disrupt the integrity and management of cases within the platform.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of the exposed GraphQL endpoint at /graphql on DFIR-IRIS instances running version 2.4.27 or earlier.

You can use network scanning or HTTP request tools to detect if the /graphql endpoint is accessible and requires only authentication without proper authorization.

• Use curl to check the endpoint: curl -i -X POST https://your-iris-instance/graphql -H "Authorization: Bearer <token>" -d '{"query":"{ case(caseId: \"1\") { iocs { id } } }"}'
• Use tools like nmap with HTTP scripts to detect the /graphql endpoint: nmap --script http-graphql-introspection -p 80,443 your-iris-instance

If the endpoint responds and returns data without proper authorization checks, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include blocking access to the /graphql endpoint at the reverse proxy level to prevent any authenticated user from reaching it.

Alternatively, you can disable the GraphQL feature by commenting out the graphql_blueprint import and the register_blueprint call in the source/app/views.py file, then restarting the application.

The ultimate fix is to upgrade DFIR-IRIS to version 2.4.28 or later, where the GraphQL feature has been completely removed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in DFIR-IRIS allows unauthorized access to sensitive information, specifically Indicators of Compromise (IOCs) across cases, due to improper authorization checks on the GraphQL endpoint. This unauthorized disclosure of sensitive data can lead to violations of data protection and privacy regulations such as GDPR and HIPAA, which require strict access controls and protection of confidential information.

Because any authenticated user can access or disclose sensitive case information without proper authorization, organizations using affected versions of DFIR-IRIS may face compliance risks related to confidentiality and data security mandates under these standards.

Useful 0 Not Useful 0