Which versions of DFIR-IRIS are affected by CVE-2026-41522?

DFIR-IRIS prior to version 2.4.28 contains an authorization bypass vulnerability (CVE-2026-41522, CVSS 7.1) that allows any authenticated user to read forensic investigation data and indicators of…. A patch is available.

How to fix or mitigate CVE-2026-41522?

Within 24 hours: Identify all DFIR-IRIS instances and confirm versions are prior to 2.4.28; disable the /graphql endpoint via application configuration if operationally feasible, or restrict network access to authorized administrators only. Within 7 days: Implement network-level access controls to /graphql endpoint; enable comprehensive audit logging of GraphQL queries; conduct forensic review of case access and IOC disclosure logs for unauthorized activity within the past 90 days. Within 30 days: Monitor DFIR-IRIS vendor security advisories and GitHub releases; upgrade all instances to v2.4.28 or later when patch becomes available.

DFIR-IRIS CVE-2026-41522

Q: What is the CVSS score of CVE-2026-41522?

CVE-2026-41522 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34320 HIGH

Improper Authorization (CWE-285)

2026-06-04 security-advisories@github.com

Authentication Bypass Python

7.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 04, 2026 - 22:01 EUVD

Analysis Generated

Jun 04, 2026 - 20:33 vuln.today

DescriptionGitHub Advisory

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can abuse it in three ways: unauthorized IOC read across cases (IDOR), bulk IOC disclosure via case.iocs. The case(caseId: …).iocs resolver returns IOCs linked to an arbitrary case without verifying the caller has access to that case, and unauthorized case creation. All three are reachable by any authenticated user, regardless of role or case ACL. This is fixed in v2.4.28. The GraphQL blueprint, resolvers, and dependencies (graphene, graphene-sqlalchemy, graphql-server[flask]) were removed entirely, since the feature was not in use. As a workaround, block /graphql at the reverse proxy (recommended) or comment out the graphql_blueprint import and register_blueprint call in source/app/views.py and restart.

AnalysisAI

Authorization bypass in DFIR-IRIS prior to v2.4.28 allows any authenticated user to read IOCs across cases they should not access, perform bulk IOC disclosure, and create cases without role checks via an optional GraphQL endpoint at /graphql. No public exploit identified at time of analysis, but the trivial nature of the IDOR (simply supplying an arbitrary caseId to the GraphQL resolver) makes weaponization straightforward for anyone with valid platform credentials. EPSS data not provided; the vulnerability is not listed in CISA KEV.

Technical ContextAI

DFIR-IRIS is a collaborative incident-response platform used by DFIR teams to share investigation artifacts (IOCs, evidence, timelines) across cases with role-based and per-case ACL controls. The flaw is rooted in CWE-285 (Improper Authorization): the platform exposes a parallel GraphQL API (built on graphene, graphene-sqlalchemy, and graphql-server[flask]) whose resolvers - notably case(caseId: …).iocs - query the data layer directly without invoking the case-ACL and role checks enforced by the REST API. Because the GraphQL blueprint was wired into the Flask app via register_blueprint but lacked equivalent authorization middleware, every resolver inherits only session authentication, not object-level authorization. The upstream fix is structural: the maintainers removed the GraphQL blueprint, resolvers, and graphene-family dependencies wholesale because the feature was not actually in production use.

RemediationAI

Vendor-released patch: upgrade to DFIR-IRIS v2.4.28, which removes the GraphQL blueprint, resolvers, and graphene/graphene-sqlalchemy/graphql-server[flask] dependencies entirely; see https://github.com/dfir-iris/iris-web/security/advisories/GHSA-3mxh-x92q-9r25 for the advisory. If immediate upgrade is not possible, the vendor-recommended workaround is to block the /graphql path at the reverse proxy (nginx/Traefik/Apache) in front of Iris, which fully neutralizes the issue with no side effects because the feature is unused in production deployments. Alternatively, comment out the graphql_blueprint import and the corresponding register_blueprint call in source/app/views.py and restart the Iris service - this is more invasive, requires redeployment on every container rebuild, and may be overwritten by upgrades, so the reverse-proxy block is preferred.