CVE-2025-64530: @apollo/composition Access Control Bypass Vulnerability
Summary
CVE-2025-64530: @apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields. Affects @apollo/composition across 4 version ranges.
< 2.9.5
>= 2.10.0-alpha.3, < 2.10.4
>= 2.11.0-preview.1, < 2.11.5
>= 2.12.0-preview.1, < 2.12.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @apollo/composition package is a crucial component of Apollo Federation, which enables the composition of multiple GraphQL services into a single data graph. This package allows developers to define access control directives to secure their GraphQL APIs. However, it has been found to have a vulnerability that can lead to improper enforcement of access controls on interface types and fields, potentially exposing sensitive data.
Vulnerability Detail
A vulnerability in Apollo Federation's composition logic allows certain queries to bypass access controls on interface types and fields. The issue arises from the incorrect handling of user-defined access control directives on interface types, which can be circumvented by querying implementing object types instead. This inconsistency can lead to unauthorized access to sensitive data, as the Apollo Router may ignore access control directives on interface types while enforcing them on object types.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.9.52.9.5npm install @apollo/composition@2.9.5 -
>= 2.10.0-alpha.3, < 2.10.42.10.4npm install @apollo/composition@2.10.4 -
>= 2.11.0-preview.1, < 2.11.52.11.5npm install @apollo/composition@2.11.5 -
>= 2.12.0-preview.1, < 2.12.12.12.1npm install @apollo/composition@2.12.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to update the package immediately, manually copy the access control requirements from interface types and fields to each implementing object type and field where appropriate. Do not remove access control requirements from the interface types and fields, as unpatched Apollo Composition will not automatically generate them in the supergraph schema.
Conclusion
The @apollo/composition package has a significant vulnerability that can lead to unauthorized access to sensitive data due to improper enforcement of access controls. It is crucial for users to update to the patched versions and adjust their access control requirements accordingly to mitigate this risk.
See every vulnerability recorded for @apollo/composition →
FAQ
The vulnerability allows unauthorized access to data by bypassing access controls on interface types and fields in Apollo Federation.
Customers using Apollo Federation who have defined access control directives on interface types and fields are impacted.
Malicious actors could craft queries that bypass access control, leading to unauthorized access to sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @apollo/composition.
