Project: 
GraphQL Core Schema
Project machine name: 
graphql_core_schema
Date: 
2026-November-11
Security risk: 
Critical 15 ∕ 25 AC:Basic/A:User/CI:Some/II:All/E:Theoretical/TD:Default
Vulnerability: 
Improper authorization
Affected versions: 
<1.0.29
CVE IDs: 
CVE-2026-126725
Description: 

This module provides a configurable GraphQL schema generator for Drupal entities and fields, along with optional schema extensions for common tasks such as user login and password management.

The module doesn't sufficiently check access when changing a user's password through the GraphQL API. A user who can view another user's account can change that account's password, including on administrator accounts. This can lead to a full account takeover.

This vulnerability is mitigated by the fact that the User Login schema extension must be enabled on a GraphQL server.

Solution: 

Install the latest version:

Sites that can't update right away can disable the User Login sphQL servers until they can update. This also removes the GraphQLlogin and password mutations, which decoupled frontends may depend on.

Reported By: 
Fixed By: 
Coordinated By: