Executive brief
Iris is a collaborative platform used by incident responders to manage and share technical details during security investigations. A security flaw in an unused component allows any logged-in user to view sensitive Indicators of Compromise (IOCs) from cases they are not authorized to see and create new cases without permission. This could lead to the exposure of confidential investigation data and unauthorized modification of case records.
Technical details
DFIR-IRIS versions prior to 2.4.28 contain an improper authorization vulnerability in the optional GraphQL endpoint located at `/graphql`. The endpoint fails to enforce the same authorization checks and Access Control Lists (ACLs) as the REST API. Authenticated users can exploit this via Insecure Direct Object Reference (IDOR) to read Indicators of Compromise (IOCs) across all cases, perform bulk IOC disclosure via the `case.iocs` resolver, and bypass permissions to create new cases using the `caseCreate` mutation. The vulnerability was addressed in version 2.4.28 by completely removing the unused GraphQL functionality and its associated dependencies.
Affected products
- dfir-iris iris-web <= 2.4.27
Timeline
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-06-04: disclosed: NVD publication date