The vulnerability in Spring for GraphQL involves improper access control due to the annotation detection mechanism not correctly resolving security annotations on methods in type hierarchies. When these annotations are used for authorization decisions, the failure to detect them properly can cause security checks to be bypassed. This affects multiple versions of Spring for GraphQL, specifically 1.0.0 through 1.0.6, 1.3.0 through 1.3.8, 1.4.0 through 1.4.5, and 2.0.0 through 2.0.3. The CVSS 3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact but no integrity or availability impact. No official patch or remediation information is provided in the data.

This vulnerability can lead to improper access control where security annotations intended to enforce authorization may be ignored at runtime. This potentially allows unauthorized users to access protected GraphQL data fetchers, compromising confidentiality. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor for vendor updates and advisories. Until a fix is available, carefully review and test authorization configurations in Spring for GraphQL applications to identify potential bypasses related to annotation detection in type hierarchies.