Spring GraphQL Authorization Annotations Bypassed in Type Hierarchies

Spring for GraphQL contains a critical flaw in its annotation detection mechanism for @Controller data fetchers that fails to properly resolve security annotations when methods exist within type hierarchies. This vulnerability allows authorization annotations to be silently ignored at runtime, potentially enabling unauthorized access to sensitive GraphQL operations. Organizations using affected versions (2.0.0-2.0.3, 1.4.0-1.4.5, 1.3.0-1.3.8, 1.0.0-1.0.6) that rely on annotation-based authorization for GraphQL endpoints face significant risk, as attackers could bypass intended access controls without triggering typical authentication failures.

While this CVE does not map to specific MITRE ATT&CK techniques, Casky's extended reasoning across 754 security skills would detect attack patterns consistent with Privilege Escalation (T1548) and Defense Evasion (T1548.005 - Abuse Elevation Control Mechanism) behaviors. Practitioners using Casky would observe findings indicating: (1) GraphQL resolver methods missing expected authorization context during static analysis, (2) annotation inheritance chain breaks in type hierarchy evaluation, and (3) data fetchers executing without credential validation despite decorated security policies. The platform's Claude-driven analysis would flag method resolution order anomalies and recommend immediate patching, along with compensating controls such as runtime GraphQL query complexity limits and centralized authorization middleware independent of annotation mechanisms.