← CVE Intelligence

CVE-2026-41856

Spring GraphQL Annotation Detection Vulnerability PUBLISHED

Description (CNA)

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

Affected (CNA)

Vendor / productVersions
Spring / Spring for GraphQLaffected 2.0.0 before 2.0.3.1; affected 1.4.0 before 1.4.5.1; affected 1.3.0 before 1.3.9; affected 1.0.0 before 1.0.7

CWE

CWE-284

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.