Lab: Accidental exposure of private GraphQL fields
Summary: PortSwigger's lab demonstrates an access control vulnerability in a GraphQL endpoint that powers user management, where an introspection query exposes the API's queries and a modified getUser query returns the administrator's credentials. The lab's administrator ID is 1, and signing in with those credentials allows deleting the user carlos.
Key Takeaway: A single introspection query mapped the API's private fields, and changing one id value from 0 to 1 handed over administrator credentials - the same sequence an attacker would run against any GraphQL endpoint that trusts client-supplied identifiers.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026