CVE-2026-41522
Iris has an Improper Authorization issue
Description
Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at `/graphql` that does not enforce the same authorization checks as the REST API. Any authenticated user can abuse it in three ways: unauthorized IOC read across cases (IDOR), bulk IOC disclosure via `case.iocs`. The `case(caseId: …).iocs` resolver returns IOCs linked to an arbitrary case without verifying the caller has access to that case, and unauthorized case creation. All three are reachable by any authenticated user, regardless of role or case ACL. This is fixed in v2.4.28. The GraphQL blueprint, resolvers, and dependencies (`graphene`, `graphene-sqlalchemy`, `graphql-server[flask]`) were removed entirely, since the feature was not in use. As a workaround, block `/graphql` at the reverse proxy (recommended) or comment out the `graphql_blueprint` import and `register_blueprint` call in `source/app/views.py` and restart.
INFO
Published Date :
June 4, 2026, 8:16 p.m.
Last Modified :
July 22, 2026, 8:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update DFIR-IRIS to version 2.4.28 or newer.
- Block access to the /graphql endpoint.
- Comment out GraphQL blueprint import and registration.
- Restart the application.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-41522.
| URL | Resource |
|---|---|
| https://github.com/dfir-iris/iris-web/security/advisories/GHSA-3mxh-x92q-9r25 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-41522 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-41522
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-41522 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-41522 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 22, 2026
Action Type Old Value New Value Added Translation Title: IRIS web de dfir-iris, Description: Iris es una plataforma web colaborativa que ayuda a los respondedores de incidentes a compartir detalles técnicos durante las investigaciones. Antes de la versión 2.4.28, DFIR-IRIS expone un endpoint GraphQL opcional en '/graphql' que no aplica las mismas comprobaciones de autorización que la API REST. Cualquier usuario autenticado puede abusar de ella de tres maneras: lectura no autorizada de IOCs entre casos (IDOR), divulgación masiva de IOCs a través de 'case.iocs'. El resolver 'case(caseId: ...).iocs' devuelve IOCs vinculados a un caso arbitrario sin verificar que el llamador tenga acceso a ese caso, y creación de casos no autorizada. Las tres son accesibles por cualquier usuario autenticado, independientemente del rol o la ACL del caso. Esto está corregido en la v2.4.28. El blueprint GraphQL, los resolvers y las dependencias ('graphene', 'graphene-sqlalchemy', 'graphql-server[flask]') fueron eliminados por completo, ya que la característica no estaba en uso. Como solución alternativa, bloquee '/graphql' en el proxy inverso (recomendado) o comente la importación de 'graphql_blueprint' y la llamada a 'register_blueprint' en 'source/app/views.py' y reinicie. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'dfir-iris', 'product': 'iris-web', 'versions': [{'status': 'affected', 'version': '< 2.4.28'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-41522', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-08T18:29:43.494130Z'} -
New CVE Received by [email protected]
Jun. 04, 2026
Action Type Old Value New Value Added Description Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at `/graphql` that does not enforce the same authorization checks as the REST API. Any authenticated user can abuse it in three ways: unauthorized IOC read across cases (IDOR), bulk IOC disclosure via `case.iocs`. The `case(caseId: …).iocs` resolver returns IOCs linked to an arbitrary case without verifying the caller has access to that case, and unauthorized case creation. All three are reachable by any authenticated user, regardless of role or case ACL. This is fixed in v2.4.28. The GraphQL blueprint, resolvers, and dependencies (`graphene`, `graphene-sqlalchemy`, `graphql-server[flask]`) were removed entirely, since the feature was not in use. As a workaround, block `/graphql` at the reverse proxy (recommended) or comment out the `graphql_blueprint` import and `register_blueprint` call in `source/app/views.py` and restart. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-285 Added Reference https://github.com/dfir-iris/iris-web/security/advisories/GHSA-3mxh-x92q-9r25