The vulnerability in DFIR-IRIS iris-web (CVE-2026-41522) involves improper authorization (CWE-285) in the optional GraphQL endpoint available at /graphql in versions prior to 2.4.28. This endpoint allows any authenticated user, regardless of role or case access control lists, to perform unauthorized IOC reads across cases (IDOR), bulk IOC disclosures via the case.iocs resolver, and unauthorized case creation. The issue arises because the GraphQL resolvers do not verify caller permissions properly. The vulnerability was remediated in version 2.4.28 by removing the GraphQL blueprint, resolvers, and related dependencies, as the feature was not in use.

Any authenticated user can access sensitive case data (IOCs) linked to arbitrary cases without authorization, potentially exposing confidential investigation details. They can also create cases without permission. This undermines access controls and confidentiality within the iris-web platform. There are no known exploits in the wild as of the publication date.

A fix is available in version 2.4.28, which removes the vulnerable GraphQL endpoint entirely. Users should upgrade to version 2.4.28 or later. As a workaround, blocking the /graphql endpoint at the reverse proxy is recommended. Alternatively, commenting out the graphql_blueprint import and register_blueprint call in source/app/views.py and restarting the application can mitigate the issue.