Apollo Router has a vulnerability in its access control enforcement for polymorphic GraphQL types. The router enforces access control directives on interface types/fields but ignores directives on their implementing object types/fields if all implementations share the same requirements. This inconsistency can allow unauthenticated queries to bypass access controls by querying via interface types/fields lacking the proper directives. The issue affects Apollo Router versions before 1.61.12 and versions from 2.0.0-alpha.0 up to but not including 2.8.1. Fixed versions are 1.61.12 and 2.8.1 and later.