The Drupal GraphQL Core Schema module has a vulnerability that allows users who can view other users' accounts to change those users' passwords via the GraphQL API, potentially leading to full account takeover. This issue affects versions prior to 1.0.29. The vulnerability is mitigated if the User Login schema extension is not enabled on the GraphQL server.