Description

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions.

Spring for GraphQL application are vulnerable when all the following are true:

• the application has Spring Security on the classpath
• the application relies on Spring Security's @EnableMethodSecurity feature for security checks
• the application is implementing @Controller classes within type hierarchies

When all the conditions above are met, the security annotations can be ignored at runtime.

Affected Spring Products and Versions

Spring for GraphQL:

• 2.0.0 - 2.0.3
• 1.4.0 - 1.4.5
• 1.3.0 - 1.3.8
• 1.0.0 - 1.0.6

Versions that are no longer supported are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

Credit

This vulnerability was discovered and responsibly reported by Bofei Chen.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N&version=3.1

History

• 2026-06-10: Initial vulnerability report published.