PT-2026-46318 · Dfir Iris · Dfir-Iris
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
DFIR-IRIS versions prior to 2.4.28
Description
An optional GraphQL endpoint at "/graphql" does not enforce the same authorization checks as the REST API. This allows any authenticated user, regardless of their role or case Access Control List (ACL), to perform unauthorized actions. These include reading Indicators of Compromise (IOC) across different cases via Insecure Direct Object Reference (IDOR), bulk disclosure of IOCs through the
case.iocs resolver—which returns IOCs linked to an arbitrary case without verifying access—and unauthorized case creation.Recommendations
Update to version 2.4.28.
Block the "/graphql" endpoint at the reverse proxy.
Comment out the
graphql blueprint import and the register blueprint call in source/app/views.py and restart the service.Exploit
Fix
Improper Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dfir-Iris