AIKIDO-2026-818766

TL;DR

GraphQL-Ruby's Execution::Next runtime does not halt execution when a field backed by GraphQL::Schema::Resolver or its subclasses (including GraphQL::Schema::Mutation, GraphQL::Schema::RelayClassicMutation, and GraphQL::Schema::Subscription) raises a GraphQL::UnauthorizedError. The resolver-thrown authorization failure is still treated as authorized, so the field or mutation continues to resolve and return data. This lets clients reach resolver and mutation logic that authorization checks should have blocked, while other forms of authorization still applied correctly. The fix marks resolver-raised UnauthorizedErrors as unauthorized so execution stops as intended.