CVE-2026-12664

GitLab CE/EE versions 18.2 before 19.3.6 , 19.4 before 19.4.3 , and 19.5 before 19.5.1 are vulnerable to an incorrect authorization issue (CWE-863). Due to insufficient scope enforcement on a GraphQL field, an authenticated user holding a read_api-scoped token could bypass token restrictions to r...

GraphQL Python GraphQL-core 3 resource management error vulnerability

In GraphQL Core for Python versions 3.0.0 through 3.2.12 and 3.3.0a1 through 3.3.0rc1, there is a resource management error vulnerability. This vulnerability stems from the OverlappingFieldsCanBeMerged rule during validation; it repeatedly compares shared response fields and recursively recompare...

GitLab authorization issue vulnerability

A security vulnerability exists in GitLab CE/EE versions from 18.2 up to and including 19.3.6, from 19.4 up to and including 19.4.3, and from 19.5 up to and including 19.5.1. This vulnerability stems from insufficient execution of GraphQL field scopes, allowing authenticated users with a readapi...

GraphQL Python GraphQL-core 3 resource management error vulnerability

In GraphQL Python, there is a resource management error vulnerability in versions 3.2.3 through 3.2.12 and 3.3.0a3 through 3.3.0rc1. This vulnerability arises because the parser’s maxtokens limit only counts non-comment tokens; however, comments that are skipped are still assigned as Tokens via...

PT-2026-120885

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 19.3.5 GitLab CE/EE versions 19.4 through 19.4.2 GitLab CE/EE versions 19.5 through 19.5.0 Description Insufficient scope enforcement on a GraphQL field allows an authenticated user possessing a read api-scop...

GitLab 18.2 < 19.3.6 / 19.4 < 19.4.3 / 19.5 < 19.5.1 (CVE-2026-12664)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an...

Oracle REST Data Services security vulnerabilities

Oracle REST Data Services versions 24.2.0 to 26.1.0 have security vulnerabilities. These vulnerabilities stem from issues with the Graph QL component, which may allow unauthenticated attackers to access the HTTP network and unauthorized access to certain accessible data...

Security Bulletin: IBM Match 360 is vulnerable to denial of service from IBM WebSphere Application Server Liberty due to GraphQL Java (CVE-2024-40094)

Summary IBM Match 360 is vulnerable to a denial of service through a vulnerability found in IBM WebSphere Application Server Liberty. This affects IBM WebSphere Application Server Liberty 20.0.0.6- 24.0.0.11 with the specified features. GraphQL Java aka graphql-java is vulnerable to a denial of...

CVE-2026-112776

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

EUVD-2026-104582

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

CVE-2026-112776 Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

CVE-2026-112776 Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

CVE-2026-112776

Craft CMS versions 5.0.0 through 5.11.0 are vulnerable to a GraphQL Site-Scope Bypass via mutations. The root cause is the failure to enforce the requireAllowedSite() function, allowing site-scoped GraphQL tokens to interact with content from other sites. An attacker holding a valid token for one...

CVE-2026-112776 Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

Oracle REST Data Services security vulnerabilities

A security vulnerability exists in Oracle REST Data Services versions 24.2.0 through 26.2.1. This vulnerability stems from issues within the GraphQL component and may allow low-privilege attackers to gain unauthorized access via HTTP, thereby accessing critical data or all accessible data...

BIT-PARSE-2026-109302 Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 GraphQL Schema Disclosure via Persisted Queries

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and...

PT-2026-117561

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and...

PT-2026-117627

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.x Description An authorization bypass exists where site-scoped GraphQL tokens can mutate content belonging to other sites. This occurs because the requireAllowedSite function is not enforced. An attacker...

CVE-2026-112776: Incorrect Authorization

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

Craft CMS authorization issue vulnerability

Craft CMS versions 5.0.0 to 5.11.0 have an authorization vulnerability. This vulnerability stems from an, as the requireAllowedSite check is not enforced. As a result, attackers with a GraphQL token from site A can create entries on site B using the provided siteId, and can delete items,...