PT-2026-46318
CVE-2026-41522
·
Published
2026-06-04
·
Updated
2026-06-04
Description by
CVSS 4.0
7.1
HighMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
DFIR-IRIS versions prior to 2.4.28
Description
An optional GraphQL endpoint at "/graphql" does not enforce the same authorization checks as the REST API. This allows any authenticated user, regardless of their role or case Access Control List (ACL), to perform unauthorized actions. These include reading Indicators of Compromise (IOC) across different cases via Insecure Direct Object Reference (IDOR), bulk disclosure of IOCs through the
case.iocs resolver—which returns IOCs linked to an arbitrary case without verifying access—and unauthorized case creation.Recommendations
Update to version 2.4.28.
Block the "/graphql" endpoint at the reverse proxy.
Comment out the
graphql blueprint import and the register blueprint call in source/app/views.py and restart the service.Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾