CVE-2026-41522: Iris has an Improper Authorization issue

Synopsis

Improper authorization in Iris (dfir-iris/iris-web) exposes a GraphQL endpoint at /graphql that skips the role and case ACL checks enforced by the REST API. Any authenticated user, regardless of privilege level, can exploit this to read IOCs from cases they have no access to (IDOR), bulk-disclose IOCs via the case.iocs resolver, and create new cases without authorization. Successful exploitation gives an attacker read access to sensitive incident investigation data and the ability to inject new cases into the platform. No fix version has been published to package registries yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an upstream release is confirmed.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable /graphql endpoint is exposed over the network, so the attacker must be able to reach the Iris web service via HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege authenticated account is sufficient; no elevated or admin role is needed to trigger the authorization bypass.

• Victim interactionNot required

  The attacker sends requests directly to the GraphQL endpoint and does not need any action from another user.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; crafting a valid GraphQL query against the unprotected resolver requires no race conditions or special environmental setup.

Blast Radius

• Reads IOCs (indicators of compromise such as file hashes, IPs, and domains) from any case in the platform, including cases the attacker has no legitimate access to.
• Bulk-discloses all IOCs linked to an arbitrary case in a single resolver call, accelerating exfiltration of incident investigation data.
• Creates new cases in the platform under any authenticated identity, allowing an attacker to inject false or misleading incident records.