A vulnerability in Apollo Federation's composition logic allowed bypassing of access controls on interface types and fields by querying implementing object types/fields instead. This occurs because Apollo Router enforces access control directives inconsistently between interfaces and their implementations. The issue affects users defining access control directives on interface types/fields, potentially allowing unauthorized data access. The vulnerability is fixed by disallowing user-defined access control directives on interface types/fields and automatically generating them based on implementations. Users must update to patched versions and adjust their schemas accordingly.