VYPR
← All advisories
High severity7.5NVD Advisory· Published Jun 11, 2026· Updated Jun 12, 2026

CVE-2026-41856

CVE-2026-41856

Description

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.

Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Spring Projects/Spring for GraphQLinferred2 versions
    >=1.0.0,<=1.0.6; >=1.3.0,<=1.3.8; >=1.4.0,<=1.4.5; >=2.0.0,<=2.0.3+ 1 more
    • (no CPE)range: >=1.0.0,<=1.0.6; >=1.3.0,<=1.3.8; >=1.4.0,<=1.4.5; >=2.0.0,<=2.0.3
    • (no CPE)range: 1.0.0 - 1.0.6, 1.3.0 - 1.3.8, 1.4.0 - 1.4.5, 2.0.0 - 2.0.3
  • VMware/Spring For Graphql
    cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:*
    Range: >=1.0.0,<1.0.7

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.