GHSA-qgm9: Missing Per-User Authorization in NL-Portal GraphQL Causes IDOR

Summary of Key Vulnerability Information Vulnerability Overview Vulnerability ID: GHSA-qgm9-h656-mxmxm Severity: Medium (CVSS 6.5/10) Vulnerability Type: Missing per-user authorization Description: Two GraphQL queries ( and ) in did not verify data ownership before returning data, allowing authenticated users to download/enumerate other users' data. Scope of Impact Affected Packages: - (Maven): - (Maven): Affected Versions: Fixed Version: Impact: - : Authenticated users can download document content owned by any user. - : Authenticated users can search/enumerate decisions (resolutions, identifications, responsible organizations, etc.) across all users and can retrieve other users' document content by enumerating decision IDs. Remediation Upgrade to 3.0.1: - : The resolver now declares an parameter, allowing the framework to pass the authenticated user into the invocation path. - : The entire module has been removed in 3.0.1; consumers must implement alternatives, performing explicit per-user authorization before the resolver. Interim Mitigations (Workarounds) If immediate upgrade is not possible, the following GraphQL operations can be blocked at the API gateway layer: - - - - - - - If operation-level blocking is not feasible, the GraphQL type of the module can be blocked, along with blocking document content queries. Technical Details 's : does not declare a parameter; the authenticated principal is not bound to the invocation path, allowing document content to be retrieved without resolver involvement. 's exposes GraphQL operations ( , , , , , ). While declares a parameter, accepts parameters such as , , , and , enabling callers to enumerate decisions across users. The fix involved removing , , and integration tests, removing the user ID from return data, and removing the entry from the application's default configuration. Notes The repository was archived on January 13, 2026, and is now read-only. The vulnerability was discovered during a penetration test of (May 1, 2026, Phase 1); vendor attribution information is pending.

Goal Reached Thanks to every supporter — we hit 100%!

GHSA-qgm9: Missing Per-User Authorization in NL-Portal GraphQL Causes IDOR

More from this source