Apollo Federation's composition logic had a vulnerability where access control directives on fields accessed transitively via @requires or @fromContext were not enforced. This allowed indirect access to protected fields by querying dependent fields without meeting access control requirements. The issue is fixed in versions 2.9.5, 2.10.4, 2.11.5, and 2.12.1 by enforcing matching access control on dependent fields. Users must update their subgraph schemas to align access control directives accordingly.