Executive brief
Spring for GraphQL is a framework that enables GraphQL APIs within Spring applications. A flaw in annotation detection allows security-related annotations (such as authorization checks) on controller data fetcher methods to be incorrectly ignored at runtime when methods are defined in generic interface hierarchies. This can allow unauthorized access to sensitive GraphQL endpoints that should be protected.
Technical details
The vulnerability exists in Spring for GraphQL's annotation detection mechanism for @Controller data fetchers. When handler methods are defined in generic interface hierarchies, the framework's bridged method matching in HandlerMethod fails to correctly resolve parameter annotations (such as @Argument and authorization annotations) on the concrete implementation. The root cause is improper type resolution when comparing bridged method parameter types using ResolvableType.resolve(), which cannot match erased parameter types. The fix uses ResolvableType.toClass() to correctly match raw classes. This is a logic flaw (CWE-284: Improper Access Control) that requires the specific condition of methods in generic interfaces, affecting only applications using such patterns for authorization enforcement. The vulnerability is network-reachable via GraphQL queries and requires no authentication or user interaction to exploit. Patches are available: versions 2.0.4, 1.4.6, and later.
Affected products
- Spring Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6
Timeline
- 2026-06-11: disclosed: Published to GitHub Advisory Database and NVD
- 2026-06-11: patched: Patched versions 2.0.4 and 1.4.6 released; 1.3.x and 1.0.x end-of-life