SA-CONTRIB-2026-316: Critical severity composer/drupal/graphql_core_schema vulnerability
This module provides a configurable GraphQL schema generator for Drupal entities and fields, along with optional schema extensions for common tasks such as user login and password management. The module doesn't sufficiently check access when changing a user's password through the GraphQL API. A user who can view another user's account can change that account's password, including on administrator accounts. This can lead to a full account takeover. This vulnerability is mitigated by the fact that the User Login schema extension must be enabled on a GraphQL server.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/graphql_core_schemato a version that resolves this vulnerability.Fixed in 1.0.29
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue is mitigated unless the User Login schema extension is enabled on a GraphQL server. Deployments using that extension may be exposed.
What access does an attacker need to take over an account?
An attacker needs the ability to view the target user's account through the GraphQL API. They can then change that user's password, including the password of an administrator account.
What is the likely impact if an administrator account is targeted?
Changing an administrator's password can result in a full account takeover.