Interpreter runtime renders results from objects whose `.authorized?` checks had failed
Published: October 29, 2026
SECURITY IDENTIFIERS
- GHSA: GHSA-q3cc-p5hm-55wj
- Vendor Advisory: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q3cc-p5hm-55wj
GEM
SEVERITY
CVSS v3.x: 6.5 (Medium)
UNAFFECTED VERSIONS
< 1.10.0
PATCHED VERSIONS
>= 2.6.14
DESCRIPTION
The legacy interpreter (Execution::Interpreter) renders the original, unauthorized object when authorized? raises GraphQL::UnauthorizedError and Schema.unauthorized_object returns a replacement. Returning false correctly renders the replacement.