GraphQL Authorization Issues
High · API Security
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-285
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-285
Definition
Resolver functions lack object-level authorization.
Root cause
Trusting client-side field selection only.
Affected components
- Components in the “API Security” class
- Application / API handlers
- Supporting libraries
Impact
Mass data exposure via nested queries.
Severity
High · CVSS 8.6
Safe lab reproduction
lab-graphql
Detection methodology
Introspection + IDOR-style GraphQL tests.
Evidence examples
- Lab reproduction notes: lab-graphql
- Request/response excerpts (redacted)
- Detection signal: Introspection + IDOR-style GraphQL tests
Remediation
AuthZ on every resolver; query cost limits.
Secure coding examples
Disable introspection in prod; depth/complexity limits.
Related CYNARKS lessons & labs
Tools: burp
Practise related skills in Labs or deepen on Academy library.