Impact

In GraphQL-Ruby < v2.6.6, when using Execution::Next, authorization failures did not properly halt execution for fields using GraphQL::Schema::Resolver (and its subclasses, including GraphQL::Schema::Mutation, GraphQL::Schema::RelayClassicMutation, and GraphQL::Schema::Subscription) when they raised GraphQL::UnauthorizedErrors. Other forms of authorization were applied correctly.

If your application uses Execution::Next, update GraphQL-Ruby to v2.6.6 or later.

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent as part of Project Glasswing, a cross-industry initiative to secure critical open-source software using frontier AI models, and manually verified by GHSL team member: @anticomputer.