CVE-2026-5432-GraphQL-Batching-Alias-Confusion-SQL-Injection

7. CVE-2026-5432 – GraphQL Batching Alias Confusion SQL Injection Overview A GraphQL resolver constructs SQL queries dynamically from field aliases. By using batching and aliases, an attacker bypasses an allow‑list and injects SQL. Severity: Critical Database Takeover Node.js Server & Exploit //...

CVE-2026-92771

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the...

PT-2026-94049

Name of the Vulnerable Software and Affected Versions Twenty versions prior to 2.35.0 Description Authenticated users can bypass permission checks due to a failure to validate field and row permissions in the groupBy-with-records GraphQL resolver. An attacker possessing the canReadObjectRecords...

CVE-2026-81633

CVE-2026-81633 is an improper input validation vulnerability in ash-project ash_graphql (Elixir GraphQL library). The function resolve_node/2 base64-decodes a client-supplied global ID and passes the type segment directly to Map.fetch!/2, which raises an unhandled KeyError when the type is not a ...

CVE-2026-63421

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose...

CVE-2026-63421 Keystone: `graphql.maxTake` bypass with negative `take`

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose...

CVE-2026-63421

Keystone (Node.js CMS) prior to 6.5.3 contains a graphql.maxTake bypass in the findMany resolver (packages/core/src/lib/core/queries/resolvers.ts). The resolver compares the signed take argument directly against the configured maxTake bound, so a remote unauthenticated GraphQL client can supply a...

PT-2026-79448

Name of the Vulnerable Software and Affected Versions Keystone versions prior to 6.5.3 Description The findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake. This allows a remote unauthenticated GraphQL client to provi...

NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

Impact In versions up to and including 3.0.0, two parts of the GraphQL API returned data without checking whether the data belonged to the logged-in user: - Document content. A logged-in user could download the raw content of any document by its ID, regardless of who owned it. The resolver has...

NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

Summary The public GraphQL resolvers getFormDefinitionByObjectenApiUrlurl and the deprecated getFormDefinitionByIdid fetch a caller-supplied URL using the privileged Objecten-API token. Because the /graphql endpoint is permitAll and these resolvers do not declare a CommonGroundAuthentication...

CVE-2026-35413

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, when GRAPHQLINTROSPECTION=false is configured, Directus correctly blocks standard GraphQL introspection queries schema, type. However, the serverspecsgraphql resolver on the /graphql/system endpoint...

Allocation of Resources Without Limits or Throttling

Overview directus is a Directus is a real-time API and App dashboard for managing SQL database content. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the GraphQL resolver process. An attacker can exhaust server resources and cause...

CVE-2025-23204

The CVE affects api-platform/core. Starting in version 3.3.8, a logic flaw in the GraphQL security flow is caused by an omitted break in the AccessCheckerProvider switch that is supposed to run after GraphQL resolvers; this fallback can bypass security checks if there is only a post-resolver secu...

WPGraphQL Plugin vulnerable to Server Side Request Forgery (SSRF)

Impact Users with capabilities to upload media editors and above are succeptible to SSRF Server-Side Request Forgery when executing the createMediaItem Mutation. Authenticated users making GraphQL requests that execute the createMediaItem could pass executable paths in the mutations filePath...