7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64530

CVE-2025-64530: @apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields

Summary

A vulnerability in Apollo Federation's composition logic allowed some queries to Apollo Router to improperly bypass access controls on types/fields. Apollo Federation incorrectly allowed user-defined access control directives on interface types/fields, which could be bypassed by instead querying the implementing object types/fields in Apollo Router via inline or named fragments. A fix to composition logic in Federation now disallows interfaces types and fields to contain user-defined access control directives.

Details

Apollo Federation allows users to specify access control directives (@authenticated, @requiresScopes, and @policy) to protect object and interface types and fields. However, the GraphQL specification does not define inheritance rules for directives from interfaces to their implementations. When querying object or interface types/fields, Apollo Router will enforce any directives on those object or interface types/fields, but ignore any directives on interface types/fields they implement. This inconsistent enforcement behavior leads to unexpected runtime security gaps.

Who is impacted

This vulnerability impacts Apollo Federation customers defining @authenticated, @requiresScopes, or @policy directives on interface types/fields.

Scope of Impact

This vulnerability could allow a malicious actor to craft a query that can bypass access control requirements on the interface types/fields by instead querying them via implementing object types/fields that don't have the same access control requirements via inline or named fragments.

Patches

This vulnerability has been fixed in Apollo Federation's composition logic by rejecting user-defined access control directives entirely on interface types and fields (note that access control directives on @interfaceObject fields are not rejected, as those are really specifying requirements on the virtual object fields). Instead, Apollo Federation's composition logic will automatically generate access control directives for interface types/fields in the supergraph schema based on the access control directives on the implementations in subgraph schemas.

Miggo Vulnerability Database

→

CVE-2025-64530

CVE-2025-64530:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@apollo/composition	npm	< 2.9.5	2.9.5
@apollo/composition	npm	>= 2.10.0-alpha.3, < 2.10.4	2.10.4
@apollo/composition	npm	>= 2.11.0-preview.1, < 2.11.5	2.11.5
@apollo/composition	npm	>= 2.12.0-preview.1, < 2.12.1	2.12.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the composition logic of Apollo Federation, which is responsible for creating a unified supergraph schema from multiple subgraph schemas. The core issue was that access control directives (@authenticated, @requiresScopes, @policy) applied to interface types or their fields were not correctly propagated to the object types that implement those interfaces in the final composed schema.

This allowed an attacker to bypass these access controls. While a query against the interface field would be protected, a query using a GraphQL fragment to directly access the same field on the implementing object type would succeed without any access control checks, as the directive was missing from the object type's definition in the supergraph.

The analysis of the patches reveals three key functions that were at the heart of this vulnerability:

Merger.propagateAuthToInterfaces: This function in composition-js/src/merging/merge.ts was intended to propagate these authorization rules. However, its logic was flawed and incomplete. The patch completely removes this function and replaces it with a more sophisticated system for calculating and merging authorization rules (accessControlAdditionalSources), which correctly handles the propagation.
AuthValidator.verifyAuthRequirementsOnSelectionSet: This function is responsible for validating that fields with transitive dependencies (like @requires) have the necessary authorization. The original implementation had complex and incorrect logic for dealing with interfaces, which failed to properly validate the auth requirements across all implementing types.
AuthRequirementsOnElement.isSubset: This helper function was used by the AuthValidator to determine if one set of auth requirements satisfied another. Its implementation of the comparison logic for Disjunctive Normal Form (DNF) was incorrect, checking for clause equality rather than logical implication. This fundamental flaw in the validation logic meant that the validation could pass incorrectly.

In summary, the vulnerability was caused by a failure to correctly propagate authorization directives from interfaces to implementing types during schema composition. The identified functions are the ones that contained this flawed composition and validation logic. The fix involved removing/rewriting this logic to correctly compute and apply the authorization directives in the final supergraph, and also adding stricter validation to prevent such configurations in subgraphs in the first place.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.