Spring GraphQL’s annotation detection mechanism can fail to resolve @Controller data fetcher annotations on methods that are inherited through type hierarchies. When this occurs, the runtime may ignore security annotations that are intended to enforce authorization, allowing a request to be processed without the expected access checks. The fundamental weakness is an Improper Access Control (CWE‑284), which can lead to unauthorized access to sensitive data or functionality that should be protected.

The affected products are Spring for GraphQL releases 1.0.0 through 1.0.6, 1.3.0 through 1.3.8, 1.4.0 through 1.4.5, and 2.0.0 through 2.0.3. Any application that includes any of these versions and relies on the annotation mechanism for authorization is potentially impacted.

This vulnerability receives a CVSS score of 7.5, indicating high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Based on the description, the attack would likely involve crafting or sending a GraphQL query that invokes an inherited method whose authorization annotations are ignored, which could be performed remotely over the network where the GraphQL endpoint is exposed. Since the exploit requires the conditions that the authorization annotations are on a method in a type hierarchy and are mistakenly bypassed, the risk materializes primarily when the application trusts these annotations alone for access control.