CVE-2026-41856
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can cause security annotations to be ignored at runtime if used for authorization decisions.
Risk Assessment
The risk is that an attacker could bypass annotation-based authorization mechanisms, gaining unauthorized access to data or functionality.
Recommendation
It is recommended to immediately upgrade Spring for GraphQL to version 2.0.4, 1.4.6, 1.3.9, or 1.0.7, depending on the branch in use.
Original NVD description (English source)
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.