The vulnerability in Spring for GraphQL involves improper access control due to the annotation detection mechanism not correctly resolving annotations on methods within type hierarchies. When security annotations are used for authorization decisions, this flaw can cause those annotations to be ignored at runtime, resulting in potential unauthorized access. The affected versions include Spring for GraphQL 1.0.0 through 1.0.6, 1.3.0 through 1.3.8, 1.4.0 through 1.4.5, and 2.0.0 through 2.0.3. The CVSS 3.1 base score is 7.5, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No official patch or remediation guidance is provided in the available data.

This vulnerability can lead to unauthorized access by bypassing security annotations used for authorization in Spring for GraphQL applications. Confidentiality of data may be compromised as a result. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and verify authorization logic in your GraphQL controllers, especially where annotations are used for access control. Consider implementing additional manual checks or compensating controls to ensure authorization is enforced correctly.