Execution::Next reuses Relay scoped authorization for unrelated child fields, disclosing protected data
Published: October 14, 2026
SECURITY IDENTIFIERS
- GHSA: GHSA-965v-9v76-5hg2
- Vendor Advisory: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-965v-9v76-5hg2
GEM
UNAFFECTED VERSIONS
< 2.5.21
PATCHED VERSIONS
>= 2.6.12
DESCRIPTION
Starting in GraphQL-Ruby 2.5.21, when using Execution::Next, connection fields whose type implemented def self.scoped(…) and used reauthorize_scoped_objects(false) would wrongly skip authorization on extra fields attached to the connections *Edge type.
Schemas that don't use Execution::Next are not affected. Connections that don't use def self.scoped and reauthorize_scoped_objects(false) are not affected. Edge types that don't have extra, application-specific fields are not affected.