CVE-2026-41522

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at `/graphql` that does not enforce the same authorization checks as the REST API. Any authenticated user can abuse it in three ways: unauthorized IOC read across cases (IDOR), bulk IOC disclosure via `case.iocs`. The `case(caseId: …).iocs` resolver returns IOCs linked to an arbitrary case without verifying the caller has access to that case, and unauthorized case creation. All three are reachable by any authenticated user, regardless of role or case ACL. This is fixed in v2.4.28. The GraphQL blueprint, resolvers, and dependencies (`graphene`, `graphene-sqlalchemy`, `graphql-server[flask]`) were removed entirely, since the feature was not in use. As a workaround, block `/graphql` at the reverse proxy (recommended) or comment out the `graphql_blueprint` import and `register_blueprint` call in `source/app/views.py` and restart.

• CWE-285

• https://github.com/dfir-iris/iris-web/security/advisories/GHSA-3mxh-x92q-9r25

Published

Jun 4, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41517Emlog is an open source website building system. Prior to ve…0
• CVE-2026-41518Chartbrew is an open-source web application that can connect…7.6
• CVE-2026-41519Weblate is a web based localization tool. Prior to version 5…5.4
• CVE-2026-4152GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code…7.8
• CVE-2026-41520Cilium is a networking, observability, and security solution…4.4
• CVE-2026-41521xrdp is an open source RDP server. Versions 0.10.6 and prior…9.1
• CVE-2026-41523vLLM is an inference and serving engine for large language m…7.5
• CVE-2026-41524Brave CMS is an open-source CMS. Prior to commit 6c56603, pa…8.7
• CVE-2026-41525KDE Dolphin before 25.12.3 allows applications in a Flatpak …6.5
• CVE-2026-41526In KDE KCoreAddons before 6.25, KShell::quoteArgs is intende…7.8
• CVE-2026-41527KDE Kleopatra before 26.08.0 on Windows allows local users t…6.9
• CVE-2026-4153GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code…7.8