high7.4
CVE-2026-59288
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application.
Impact
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring For Graphql | from 1.0.0 before 1.0.8 from 1.1.0 before 1.3.10 from 1.4.0 before 1.4.7 from 2.0.0 before 2.0.4.1 |