Execution::Next renders objects whose authorized? check failed
Published: October 29, 2026
SECURITY IDENTIFIERS
- GHSA: GHSA-4rw8-495r-pf6j
- Vendor Advisory: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-4rw8-495r-pf6j
GEM
SEVERITY
CVSS v3.x: 7.5 (High)
UNAFFECTED VERSIONS
< 2.5.20
PATCHED VERSIONS
>= 2.6.14
DESCRIPTION
In some cases, GraphQL::Execution::Next rendered results for objects whose .authorized? hooks indicated that the object was unauthorized.