Apollo Router contained a vulnerability where renamed access control directives via @link imports were not properly enforced. This allowed unauthorized queries to bypass element-level access controls such as @authenticated, @requiresScopes, and @policy directives when renamed. The issue affects Apollo Router versions prior to 1.61.12 and versions from 2.0.0-alpha.0 up to but not including 2.8.1. The vulnerability has been fixed by updating the access control logic to respect renamed directives. Users should update to versions 1.61.12 or later, or 2.8.1 or later, or remove renames of these directives as a workaround.