CVE-2026-126725: Composer/drupal/graphql_core_schema vulnerability
This module provides a configurable GraphQL schema generator for Drupal entities and fields, along with optional schema extensions for common tasks such as user login and password management.
The module doesn't sufficiently check access when changing a user's password through the GraphQL API. A user who can view another user's account can change that account's password, including on administrator accounts. This can lead to a full account takeover.
This vulnerability is mitigated by the fact that the User Login schema extension must be enabled on a GraphQL server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/graphql_core_schemato a version that resolves this vulnerability.Fixed in 1.0.29
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only GraphQL servers with the User Login schema extension enabled are affected. The vulnerable password-change path also requires that a user can view the target account.
What level of access does an attacker need?
An attacker needs an account that can view another user's account through the GraphQL API. That access can be used to change the other account's password, including an administrator account's password.
What is the potential impact if an administrator account is targeted?
The attacker can take over the administrator account by changing its password. This can result in full account takeover.