GraphQL Authorization Bypass: A Real CVE Code Review

A GraphQL authorization flaw let authenticated users reach other tenants’ private data through valid queries.

Root-level checks were not enough; nested resolvers could still return another user’s record and private fields.

The issue, tied to CVE-2023-26489 and seen in systems like Apollo Server and wasmCloud, highlights a common GraphQL security pitfall.

The fix is to enforce authorization in each sensitive resolver or through schema-level directives, not only at the query root.