Executive Summary

This vulnerability in Apollo Router Core occurs because the router incorrectly handles access control directives on interface types/fields and their implementing object types/fields. Specifically, it applies access control directives to interface types/fields but ignores directives on their implementing object types/fields when all implementations have the same requirements. This flaw allows unauthenticated queries to access data that should require additional access controls, impacting customers who define @authenticated, @requiresScopes, or @policy directives inconsistently on polymorphic types.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow unauthenticated users to access sensitive data that should be protected by access control directives. This means that data requiring authentication or specific scopes could be exposed to unauthorized parties, potentially leading to data breaches or unauthorized data disclosure.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Apollo Router Core to version 1.61.12 or 2.8.1 or later, as these versions contain the fix for the vulnerability. Additionally, review and ensure consistent application of @authenticated, @requiresScopes, or @policy directives on polymorphic types in your schema to avoid inconsistent access control.

Useful 0 Not Useful 0