CVE-2026-41522
GraphQL Authorization Bypass in DFIR-IRIS
Publication date: 2026-06-04
Last updated on: 2026-06-04
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dfir-iris | iris | to 2.4.28 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-41522 is an improper authorization vulnerability in the DFIR-IRIS application versions 2.4.27 and earlier. It involves an exposed GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API.
This flaw allows any authenticated user to perform unauthorized actions including: reading Indicators of Compromise (IOCs) across cases without permission (IDOR), bulk disclosure of IOCs linked to arbitrary cases, and creating cases without proper authorization.
The vulnerability exists because the GraphQL endpoint fails to verify if the user has access rights to the requested cases, unlike the REST API. The issue was fixed in version 2.4.28 by removing the GraphQL feature entirely.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive information, specifically Indicators of Compromise (IOCs) across different cases, which could expose confidential investigation details.
An attacker with any authenticated user privileges can exploit this to read data they should not have access to, potentially compromising the confidentiality of incident response investigations.
Additionally, unauthorized case creation could disrupt the integrity and management of cases within the platform.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the exposed GraphQL endpoint at /graphql on DFIR-IRIS instances running version 2.4.27 or earlier.
You can use network scanning or HTTP request tools to detect if the /graphql endpoint is accessible and requires only authentication without proper authorization.
- Use curl to check the endpoint: curl -i -X POST https://your-iris-instance/graphql -H "Authorization: Bearer <token>" -d '{"query":"{ case(caseId: \"1\") { iocs { id } } }"}'
- Use tools like nmap with HTTP scripts to detect the /graphql endpoint: nmap --script http-graphql-introspection -p 80,443 your-iris-instance
If the endpoint responds and returns data without proper authorization checks, the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include blocking access to the /graphql endpoint at the reverse proxy level to prevent any authenticated user from reaching it.
Alternatively, you can disable the GraphQL feature by commenting out the graphql_blueprint import and the register_blueprint call in the source/app/views.py file, then restarting the application.
The ultimate fix is to upgrade DFIR-IRIS to version 2.4.28 or later, where the GraphQL feature has been completely removed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in DFIR-IRIS allows unauthorized access to sensitive information, specifically Indicators of Compromise (IOCs) across cases, due to improper authorization checks on the GraphQL endpoint. This unauthorized disclosure of sensitive data can lead to violations of data protection and privacy regulations such as GDPR and HIPAA, which require strict access controls and protection of confidential information.
Because any authenticated user can access or disclose sensitive case information without proper authorization, organizations using affected versions of DFIR-IRIS may face compliance risks related to confidentiality and data security mandates under these standards.