AIKIDO-2026-164230

graphql is vulnerable to Incorrect Authorization

GHSA-p3g2-4c7r-4fwwPublished Sep 23, 2026

CVE Score

High

Incorrect Authorization

TL;DR

GraphQL::Schema::Member::HasArguments#authorize_application_object always returns true for an argument's loads: Object type when that type is not used as a field return type or reachable through an Interface/Union anywhere in the schema, without checking that the object loaded from the client supplied ID matches the declared type. A client supplied global ID for a different type can be loaded and authorized through such an argument as if it matched the expected loads: type. The fix requires the resolved object's type to exactly equal the declared loads: type before authorizing it.

How do I fix this?

Upgrade the graphql library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you declare an argument with loads: referencing an Object type that is not otherwise used as a return type (or reachable through an Interface/Union) elsewhere in your schema.