A critical authorization bypass vulnerability in Apollo Router Core allows unauthenticated attackers to access sensitive data by exploiting inconsistent directive handling on polymorphic types.

The router incorrectly applies access control directives (such as @authenticated, @requiresScopes, or @policy) to interface types while ignoring them on implementing object types. This logic error allows an unauthenticated user to query fields that should be protected by authorization policies.

This vulnerability poses a significant risk to data confidentiality, as it enables unauthorized access to sensitive information within a federated supergraph. Given the CVSS score of 7.5, the flaw is classified as High severity. Organizations relying on Apollo Router for centralized authorization may face unauthorized data exposure, regulatory compliance violations, and potential reputational damage if protected internal data is accessed by unauthorized parties.

Immediate Action: Upgrade to Apollo Router Core version 1.61.12 or 2.8.1 immediately to apply the necessary security fixes for directive handling.

Proactive Monitoring: Review GraphQL query logs for suspicious patterns or unauthorized access attempts targeting polymorphic types or sensitive fields protected by authorization directives.

Compensating Controls: While a patch is available, organizations unable to update immediately should review their schema to ensure authorization directives are applied consistently across both interface and object types as a temporary mitigation.

Public Exploit Available: No (exploit_available: unknown).

The authorization bypass in Apollo Router Core represents a critical failure in security policy enforcement. All administrators managing federated graphs with Apollo Router must prioritize the transition to version 1.61.12 or 2.8.1. Failure to patch leaves the underlying data layer exposed to unauthenticated queries, and immediate remediation is required to maintain the integrity of the organization's data access controls.