Technical impact
DFIR-IRIS Web exposes a GraphQL endpoint that performs no authorization checks. An authenticated user can therefore leak IOCs from any case, discover large numbers of IOCs through the case.iocs resolver, and create new cases that should not be allowed. This represents a direct confidentiality breach and an integrity violation, as attackers can read sensitive information and create bogus cases, potentially disrupting investigations. The weakness is a classic Improper Authorization defect (CWE‑285).
Affected Systems
The vulnerability affects the DFIR‑IRIS web platform, versions earlier than 2.4.28. Users of v2.4.28 and later are not impacted, as the GraphQL feature has been removed entirely. The system runs on the standard IRIS‑Web stack, exposing /graphql to authenticated users without additional checks.
Risk and Exploitability
The CVSS score of 7.1 indicates a high severity flaw, but the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, implying no known active exploits at this time. Attackers only need valid credentials to reach the endpoint; thus the attack vector is authenticated session in the web interface. The flaw can be exploited without privilege escalation, making it a low‑barrier threat for any user with access to the platform. The most straightforward remediation is to block or remove the endpoint at the reverse proxy or to install the patched version.
