← Back

CVE-2026-41856

nvd nist
Published: Jun 11, 2026Modified: Jun 12, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: security@vmware.com (Secondary)

Description

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

Affected (4)

Vmware
1 product
Spring For Graphql
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring For Graphql
From 1.0.0 to 1.0.7
Spring For Graphql
From 1.3.0 to 1.3.9
Spring For Graphql
From 1.4.0 to 1.4.6
Spring For Graphql
From 2.0.0 to 2.0.4

Related CWEs

CWE-284
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.