AIKIDO-2026-164230
graphql is vulnerable to Incorrect Authorization
75
High Risk
This Affects:
graphqlTL;DR
GraphQL::Schema::Member::HasArguments#authorize_application_object always returns true for an argument's loads: Object type when that type is not used as a field return type or reachable through an Interface/Union anywhere in the schema, without checking that the object loaded from the client supplied ID matches the declared type. A client supplied global ID for a different type can be loaded and authorized through such an argument as if it matched the expected loads: type. The fix requires the resolved object's type to exactly equal the declared loads: type before authorizing it.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you declare an argument with loads: referencing an Object type that is not otherwise used as a return type (or reachable through an Interface/Union) elsewhere in your schema.
Background info
graphql is vulnerable to Incorrect Authorization in versions 2.1.2 - 2.6.10.
How to fix this
Upgrade the graphql library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.