GHSA-j7xr-4g94-r9h3

Unknown

Published: —Translated: 01/08/2026(UTC)NVD NIST

Summary

In GraphQL-Ruby before version 2.6.6, when using Execution::Next, authorization failures did not properly halt execution for fields using GraphQL::Schema::Resolver and its subclasses (including Mutation, RelayClassicMutation, and Subscription).

Risk Assessment

The organization is at risk of unauthorized access to data or operations, as the authorization mechanism may be bypassed, potentially leading to data confidentiality and integrity breaches.

Recommendation

Immediately update the GraphQL-Ruby library to version 2.6.6 or later, which includes a fix for this vulnerability.

Other vulnerabilities in GraphQL-Ruby

GHSA-rmxg-5p3r-j6hhUnknown
The vulnerability in GraphQL::Language::Cache#fetch reads parser cache files and passes their contents directly to Marshal.load without authenticating the payloads. If an attacker can place a crafted payload in the expected path and the application calls GraphQL::Language::Parser.parse_file, arbitrary code execution may occur.

Original NVD description (English source)

## Impact In GraphQL-Ruby < v2.6.6, when using Execution::Next, authorization failures did not properly halt execution for fields using GraphQL::Schema::Resolver (and its subclasses, including GraphQL::Schema::Mutation, GraphQL::Schema::RelayClassicMutation, and GraphQL::Schema::Subscription) when

Vulnerability data from NVD (NIST) · CISA KEV · EPSS