Graphql
Monthly
Authorization bypass in Craft CMS 5.0.0 through 5.10.x allows an authenticated holder of a narrowly site-scoped GraphQL token to create entries in other sites and to delete entries, categories, tags and assets shared across sites. The bypass exists because the requireAllowedSite() check applied to GraphQL queries is not enforced on mutation resolvers, so an attacker can simply supply a siteId outside the token's scope and have the write succeed. Only multi-site installations with the GraphQL API and mutation-enabled, site-scoped tokens are exposed; single-site installs and read-only GraphQL schemas are not affected, and no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is integrity and availability only (no confidentiality loss), but deletion of shared elements can corrupt content consumed by multiple sites.
Server-side request forgery in Chaskiq through 2.0.3 allows unauthenticated attackers to make the server fetch arbitrary URLs-including internal network resources and cloud instance metadata endpoints-by submitting crafted requests to the createUrlUpload GraphQL mutation. The fetched content is stored as an ActiveStorage blob and returned to the attacker, enabling exfiltration of sensitive data such as IAM credentials from IMDSv1 endpoints. With a CVSS 9.2 severity and no authentication required, this is a high-priority issue; at time of analysis, no public exploit code was identified, though a technical writeup is publicly available. Note: confirmed actively exploited (CISA KEV) is not applicable; no public exploit identified at time of analysis.
Prototype pollution in `@graphql-tools/utils` `mergeDeep()` lets a remote, unauthenticated client submit a single aliased GraphQL query that overwrites inherited JavaScript built-ins such as `Function.prototype.call`, causing denial of service against the gateway or schema-stitching service until it is restarted. Only deployments built on @graphql-tools/utils <= 12.0.0 that actually merge objects returned from two subgraphs (the ordinary `@shareable` field or cross-subgraph entity case, e.g. Hive Gateway) invoke the vulnerable code path; single-subgraph servers are not affected. Both CVSS 4.0 (8.2, AV:N/AC:L/AT:P/PR:N/UI:N/VA:H) and the assessor's CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree on high availability impact with no confidentiality or integrity impact, and no public exploit code has been identified at time of analysis.
Field-level read permission bypass in Twenty CRM before 2.22.0 lets an authenticated workspace member or API key that is allowed to read an object but explicitly denied read on a specific field still reference that denied field inside GraphQL or REST filter predicates, turning the returned totalCount and row presence into a boolean/count oracle that can reconstruct the hidden values. The vulnerability is a bounded confidentiality issue: exploitation requires a principal whose role actually configures field-level read restrictions, and reconstruction only works against records already visible under that principal's row-level policy, and it is iterative across many queries rather than a single-shot dump. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released a patch in Twenty 2.22.0.
Unauthenticated denial of service in GitLab CE/EE (all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2) allows a remote attacker with no credentials to exhaust server resources through the GraphQL API by submitting queries whose true cost the complexity calculation under-counts. The flaw is an improper resource-allocation limit (CWE-770), scored CVSS 7.5 with the entire impact on availability (A:H) and none on confidentiality or integrity. Publicly available exploit code exists - a HackerOne report is linked from the advisory - but there is no CISA KEV listing, so active in-the-wild exploitation is not confirmed; EPSS data was not supplied with this record.
Authentication bypass in @neo4j/graphql exposes admin-restricted custom-resolver fields to any authenticated user holding a legitimately issued, non-admin JWT. When both a type-level @authentication directive and a stricter field-level @authentication directive are declared on the same Query or Mutation type, the library silently discards the field-level rule and evaluates only the coarser type-level check - meaning a roles: ["user"] token is sufficient to invoke a field that requires roles_INCLUDES: "admin". Affected across three major branches (5.2.0-5.12.14, 6.0.0-6.6.4, 7.0.0-7.5.x); no public exploit or CISA KEV listing identified at time of analysis.
JWT authentication bypass in @neo4j/graphql allows unauthenticated remote clients to forge arbitrary JWT claims over GraphQL-over-WebSocket connections, bypassing @authentication and @subscriptionsAuthorization directive controls. Affected library versions prior to 7.5.6 (v7 branch) and 5.12.14 (v5 branch) accept client-supplied, pre-decoded JWT objects in subscription connectionParams without any cryptographic verification, meaning the library treats attacker-controlled identity claims as authenticated. No public exploit or KEV listing has been identified at time of analysis, but the exploitation barrier is low given the network-accessible vector and absence of authentication requirements.
Unauthenticated organization provisioning through the GraphQL Mutation.createOrg operation in ROOST Coop releases before 1.0.0 lets any remote actor who can reach a publicly exposed instance create arbitrary organization records and, with no rate limiting on the operation, generate log noise or drive database resource exhaustion. No credentials or user interaction are needed (PR:N/UI:N in the assessed vector), and impact stays bounded at low integrity and low availability with no confidentiality loss; the vendor's decisive limiting factor is network placement, since running Coop on an authenticated private network prevents outside actors from querying the GraphQL API at all. The issue is not in CISA KEV and no active exploitation is confirmed, a public PoC reference (a sample GraphQL mutation) exists in the advisory but is not verified as working exploit code, and the flaw is fixed in version 1.0.0.
ArcadeDB versions 21.12.1 through 26.10.1 allow an authenticated user who holds only the readRecord privilege to overwrite the database's shared GraphQL schema through the read-only /api/v1/query/{database} endpoint, so later GraphQL queries issued by other users - including administrators - return the attacker-chosen result. The root cause is a missing authorization check (CWE-862): a GraphQL type definition carrying a crafted @sql directive was not treated as a schema change, even though the same user is correctly refused a CREATE DOCUMENT TYPE with 403 for lacking updateSchema. The vendor fixed this in 26.10.2; there is no CISA KEV listing or exploitation reporting, and because directive statements execute with the querying user's own privileges there is no data write and no privilege escalation - only manipulation of what other users see. A public proof-of-concept walkthrough is included in the vendor advisory; it is a documented reproduction, not verified working exploit code.
Unauthenticated information disclosure in Oracle REST Data Services' GraphQL component (versions 24.2.0 through 26.1.0) lets a remote attacker with HTTP access read a subset of data accessible through ORDS, with no credentials or user interaction required. Rated 5.3 by Oracle and carrying a matching assessed vector (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N), the flaw is confined to confidentiality impact - no writes, no denial of service. Real-world exposure depends on whether the GraphQL endpoint is actually deployed and reachable; no public exploit code or confirmed active exploitation was identified at time of analysis.
Uncontrolled resource consumption in the Strawberry GraphQL library's legacy graphql-ws subscription handler (versions 0.312.3 up to but not including 0.327.2) allows an unauthenticated remote client on a persistent WebSocket connection to fill that connection's configured subscription slots with one-shot subscriptions that have already completed, so later legitimate operations on the same connection are rejected with 'Subscription limit reached'. The impact is limited to the attacker's own connection and to availability (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), requiring the non-default max_subscriptions_per_connection cap to be explicitly configured and the legacy graphql-ws protocol to be in use; the modern graphql-transport-ws protocol and deployments without the cap are unaffected. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, but a vendor fix is available in 0.327.2.
Stump through 0.1.10 allows any authenticated user with the shared AccessSmartList permission to overwrite, delete, or take over other users' smart lists via vulnerable GraphQL mutations. The updateSmartList and deleteSmartList mutations lack a creator check, enabling attackers to set themselves as the new creator and change list visibility to PRIVATE, locking out the original owner. Publicly available exploit code exists, but exploitation requires a multi-user Stump instance and low-privileged credentials, limiting impact to insiders or compromised accounts.
GraphQL query injection in Rapid7 Bulk Export MCP 0.2.5 through 0.6.1 allows an authenticated high-privileged actor who can influence the export_id argument used by the check_rapid7_export_status and download_rapid7_export tools to terminate the intended export(id: "...") selection and append attacker-controlled root-level selections such as schema introspection. The impact is confined to confidentiality (CVSS 2.7, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), because every injected query executes inside the operator's own already-authenticated Rapid7 API key scope and cannot cross a tenant or account boundary - a directly-malicious operator gains nothing beyond what direct API access already provides, so realistic exposure requires a compromised or careless upstream MCP client or indirect prompt injection forwarding an unvalidated identifier. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the vendor-released fix is version 0.6.2, which parameterizes export_id as a GraphQL variable.
Unauthenticated attackers can publish arbitrary persisted query documents and claim (squat) query aliases on WordPress sites running the WPGraphQL Smart Cache plugin before 2.3.2, because the plugin neither requires authorization for the storage request nor validates the caller-supplied query identifier. WPScan reports that publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV); scoring is CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) and the independent assessment characterizes this as a moderate, integrity-focused risk. Practical impact is bounded by whether the site actually depends on persisted queries and aliases and by a first-claim race - the attacker must register an alias before the site's own frontend does - and WPGraphQL's own access controls still govern what any stored query can return, so confidentiality loss is not demonstrated.
Unauthenticated attackers can retrieve hidden catalog entities from Vendure's publicly accessible Shop API by setting the filterOperator argument to OR, which causes the mandatory visibility guard to be OR-combined with the caller's own filters instead of AND-combined. The flaw affects the npm package @vendure/core in all versions from 1.0.0 up to (but not including) 3.6.5 and exposes disabled products and private collections or facets through the products, collections, and facets list queries. CVSS 3.1 is 5.3 (Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), consistent with read-only information disclosure; no public exploit identified at time of analysis, although the upstream fix commit and its regression tests are publicly visible.
Authenticated users can disclose sensitive information from private projects in GitLab Enterprise Edition through crafted GraphQL queries, affecting versions 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2. The flaw is an authorization bypass (CWE-639) with low confidentiality impact (CVSS 4.3) and requires a valid EE account. This is a genuine but low-priority authorization flaw; no public exploit code was identified, and the EPSS score is 0.24% (14th percentile).
silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
`silverstripe/graphql` serves Silverstripe data as GraphQL representations. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Authorization bypass in Craft CMS 5.0.0 through 5.10.x allows an authenticated holder of a narrowly site-scoped GraphQL token to create entries in other sites and to delete entries, categories, tags and assets shared across sites. The bypass exists because the requireAllowedSite() check applied to GraphQL queries is not enforced on mutation resolvers, so an attacker can simply supply a siteId outside the token's scope and have the write succeed. Only multi-site installations with the GraphQL API and mutation-enabled, site-scoped tokens are exposed; single-site installs and read-only GraphQL schemas are not affected, and no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is integrity and availability only (no confidentiality loss), but deletion of shared elements can corrupt content consumed by multiple sites.
Server-side request forgery in Chaskiq through 2.0.3 allows unauthenticated attackers to make the server fetch arbitrary URLs-including internal network resources and cloud instance metadata endpoints-by submitting crafted requests to the createUrlUpload GraphQL mutation. The fetched content is stored as an ActiveStorage blob and returned to the attacker, enabling exfiltration of sensitive data such as IAM credentials from IMDSv1 endpoints. With a CVSS 9.2 severity and no authentication required, this is a high-priority issue; at time of analysis, no public exploit code was identified, though a technical writeup is publicly available. Note: confirmed actively exploited (CISA KEV) is not applicable; no public exploit identified at time of analysis.
Prototype pollution in `@graphql-tools/utils` `mergeDeep()` lets a remote, unauthenticated client submit a single aliased GraphQL query that overwrites inherited JavaScript built-ins such as `Function.prototype.call`, causing denial of service against the gateway or schema-stitching service until it is restarted. Only deployments built on @graphql-tools/utils <= 12.0.0 that actually merge objects returned from two subgraphs (the ordinary `@shareable` field or cross-subgraph entity case, e.g. Hive Gateway) invoke the vulnerable code path; single-subgraph servers are not affected. Both CVSS 4.0 (8.2, AV:N/AC:L/AT:P/PR:N/UI:N/VA:H) and the assessor's CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree on high availability impact with no confidentiality or integrity impact, and no public exploit code has been identified at time of analysis.
Field-level read permission bypass in Twenty CRM before 2.22.0 lets an authenticated workspace member or API key that is allowed to read an object but explicitly denied read on a specific field still reference that denied field inside GraphQL or REST filter predicates, turning the returned totalCount and row presence into a boolean/count oracle that can reconstruct the hidden values. The vulnerability is a bounded confidentiality issue: exploitation requires a principal whose role actually configures field-level read restrictions, and reconstruction only works against records already visible under that principal's row-level policy, and it is iterative across many queries rather than a single-shot dump. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released a patch in Twenty 2.22.0.
Unauthenticated denial of service in GitLab CE/EE (all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2) allows a remote attacker with no credentials to exhaust server resources through the GraphQL API by submitting queries whose true cost the complexity calculation under-counts. The flaw is an improper resource-allocation limit (CWE-770), scored CVSS 7.5 with the entire impact on availability (A:H) and none on confidentiality or integrity. Publicly available exploit code exists - a HackerOne report is linked from the advisory - but there is no CISA KEV listing, so active in-the-wild exploitation is not confirmed; EPSS data was not supplied with this record.
Authentication bypass in @neo4j/graphql exposes admin-restricted custom-resolver fields to any authenticated user holding a legitimately issued, non-admin JWT. When both a type-level @authentication directive and a stricter field-level @authentication directive are declared on the same Query or Mutation type, the library silently discards the field-level rule and evaluates only the coarser type-level check - meaning a roles: ["user"] token is sufficient to invoke a field that requires roles_INCLUDES: "admin". Affected across three major branches (5.2.0-5.12.14, 6.0.0-6.6.4, 7.0.0-7.5.x); no public exploit or CISA KEV listing identified at time of analysis.
JWT authentication bypass in @neo4j/graphql allows unauthenticated remote clients to forge arbitrary JWT claims over GraphQL-over-WebSocket connections, bypassing @authentication and @subscriptionsAuthorization directive controls. Affected library versions prior to 7.5.6 (v7 branch) and 5.12.14 (v5 branch) accept client-supplied, pre-decoded JWT objects in subscription connectionParams without any cryptographic verification, meaning the library treats attacker-controlled identity claims as authenticated. No public exploit or KEV listing has been identified at time of analysis, but the exploitation barrier is low given the network-accessible vector and absence of authentication requirements.
Unauthenticated organization provisioning through the GraphQL Mutation.createOrg operation in ROOST Coop releases before 1.0.0 lets any remote actor who can reach a publicly exposed instance create arbitrary organization records and, with no rate limiting on the operation, generate log noise or drive database resource exhaustion. No credentials or user interaction are needed (PR:N/UI:N in the assessed vector), and impact stays bounded at low integrity and low availability with no confidentiality loss; the vendor's decisive limiting factor is network placement, since running Coop on an authenticated private network prevents outside actors from querying the GraphQL API at all. The issue is not in CISA KEV and no active exploitation is confirmed, a public PoC reference (a sample GraphQL mutation) exists in the advisory but is not verified as working exploit code, and the flaw is fixed in version 1.0.0.
ArcadeDB versions 21.12.1 through 26.10.1 allow an authenticated user who holds only the readRecord privilege to overwrite the database's shared GraphQL schema through the read-only /api/v1/query/{database} endpoint, so later GraphQL queries issued by other users - including administrators - return the attacker-chosen result. The root cause is a missing authorization check (CWE-862): a GraphQL type definition carrying a crafted @sql directive was not treated as a schema change, even though the same user is correctly refused a CREATE DOCUMENT TYPE with 403 for lacking updateSchema. The vendor fixed this in 26.10.2; there is no CISA KEV listing or exploitation reporting, and because directive statements execute with the querying user's own privileges there is no data write and no privilege escalation - only manipulation of what other users see. A public proof-of-concept walkthrough is included in the vendor advisory; it is a documented reproduction, not verified working exploit code.
Unauthenticated information disclosure in Oracle REST Data Services' GraphQL component (versions 24.2.0 through 26.1.0) lets a remote attacker with HTTP access read a subset of data accessible through ORDS, with no credentials or user interaction required. Rated 5.3 by Oracle and carrying a matching assessed vector (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N), the flaw is confined to confidentiality impact - no writes, no denial of service. Real-world exposure depends on whether the GraphQL endpoint is actually deployed and reachable; no public exploit code or confirmed active exploitation was identified at time of analysis.
Uncontrolled resource consumption in the Strawberry GraphQL library's legacy graphql-ws subscription handler (versions 0.312.3 up to but not including 0.327.2) allows an unauthenticated remote client on a persistent WebSocket connection to fill that connection's configured subscription slots with one-shot subscriptions that have already completed, so later legitimate operations on the same connection are rejected with 'Subscription limit reached'. The impact is limited to the attacker's own connection and to availability (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), requiring the non-default max_subscriptions_per_connection cap to be explicitly configured and the legacy graphql-ws protocol to be in use; the modern graphql-transport-ws protocol and deployments without the cap are unaffected. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, but a vendor fix is available in 0.327.2.
Stump through 0.1.10 allows any authenticated user with the shared AccessSmartList permission to overwrite, delete, or take over other users' smart lists via vulnerable GraphQL mutations. The updateSmartList and deleteSmartList mutations lack a creator check, enabling attackers to set themselves as the new creator and change list visibility to PRIVATE, locking out the original owner. Publicly available exploit code exists, but exploitation requires a multi-user Stump instance and low-privileged credentials, limiting impact to insiders or compromised accounts.
GraphQL query injection in Rapid7 Bulk Export MCP 0.2.5 through 0.6.1 allows an authenticated high-privileged actor who can influence the export_id argument used by the check_rapid7_export_status and download_rapid7_export tools to terminate the intended export(id: "...") selection and append attacker-controlled root-level selections such as schema introspection. The impact is confined to confidentiality (CVSS 2.7, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), because every injected query executes inside the operator's own already-authenticated Rapid7 API key scope and cannot cross a tenant or account boundary - a directly-malicious operator gains nothing beyond what direct API access already provides, so realistic exposure requires a compromised or careless upstream MCP client or indirect prompt injection forwarding an unvalidated identifier. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the vendor-released fix is version 0.6.2, which parameterizes export_id as a GraphQL variable.
Unauthenticated attackers can publish arbitrary persisted query documents and claim (squat) query aliases on WordPress sites running the WPGraphQL Smart Cache plugin before 2.3.2, because the plugin neither requires authorization for the storage request nor validates the caller-supplied query identifier. WPScan reports that publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV); scoring is CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) and the independent assessment characterizes this as a moderate, integrity-focused risk. Practical impact is bounded by whether the site actually depends on persisted queries and aliases and by a first-claim race - the attacker must register an alias before the site's own frontend does - and WPGraphQL's own access controls still govern what any stored query can return, so confidentiality loss is not demonstrated.
Unauthenticated attackers can retrieve hidden catalog entities from Vendure's publicly accessible Shop API by setting the filterOperator argument to OR, which causes the mandatory visibility guard to be OR-combined with the caller's own filters instead of AND-combined. The flaw affects the npm package @vendure/core in all versions from 1.0.0 up to (but not including) 3.6.5 and exposes disabled products and private collections or facets through the products, collections, and facets list queries. CVSS 3.1 is 5.3 (Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), consistent with read-only information disclosure; no public exploit identified at time of analysis, although the upstream fix commit and its regression tests are publicly visible.
Authenticated users can disclose sensitive information from private projects in GitLab Enterprise Edition through crafted GraphQL queries, affecting versions 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2. The flaw is an authorization bypass (CWE-639) with low confidentiality impact (CVSS 4.3) and requires a valid EE account. This is a genuine but low-priority authorization flaw; no public exploit code was identified, and the EPSS score is 0.24% (14th percentile).
silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
`silverstripe/graphql` serves Silverstripe data as GraphQL representations. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.