Spring GraphQL Annotation Detection Vulnerability (Spring Spring for GraphQL)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.35 % · percentile 29 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- vmware
- NVD status
- Analyzed
Description
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
Weaknesses (CWE)
- CWE-284 — Improper Access Control
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | vmware |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · security@vmware.com (Secondary) |
Advisories
- GHSA-phxq-526m-79px — Spring for GraphQL: Annotation Detection Vulnerability
European references
- ENISA EUVD · EUVD-2026-36214
- GCVE · GCVE-0-2026-41856
CERT-FR advisories
- CERTFR-2026-AVI-0759 — Multiples vulnérabilités dans les produits Spring · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:*≥ 1.0.0 < 1.0.7cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:*≥ 1.3.0 < 1.3.9cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:*≥ 1.4.0 < 1.4.5.1cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:*≥ 2.0.0 < 2.0.3.1
Affected products
| Product | Versions |
|---|---|
| Spring · Spring for GraphQL | affected 2.0.0 < 2.0.3.1 ; affected 1.4.0 < 1.4.5.1 ; affected 1.3.0 < 1.3.9 ; affected 1.0.0 < 1.0.7 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |