Chaining unauthenticated mutations, GraphQL batching abuse, and IDOR into full cross-tenant compromise

How a seemingly harmless GraphQL query exposed private user history and highlighted the importance of authorization in nested resolvers.

TL;DR A high-severity authentication bypass affects the Neo4j GraphQL Library before versions 7.5.6 and 5.12.14. Tracked as CVE-2026-5423 (CVSS 8.2), it lets an unauthenticated attacker forge JWT …

How design, security, and monetization are redefining what an API is for

A walkthrough of a GraphQL API assessment on a business application handling employee, product, and customer data — six confirmed findings…

TL;DR GitLab shipped an out-of-band critical patch on August 17, 2026. It fixes CVE-2026-19478, a GraphQL code injection flaw rated CVSS 9.4. Under certain conditions, an unauthenticated attacker …

No login. No token. No special header. Just a filter argument nobody validated.

User Records Without Authentication

While testing a web application, I was looking at its GraphQL endpoint and started checking how it handled invalid queries.

Think GraphQL is secure by default? Think again! Let me walk you through exactly how I chained a simple misconfiguration into a full…

An anonymized case study of alias-based query batching, response oracles, and why request-level rate limits may not measure the real work.

Hi everyone, in this article we’ll talk about GraphQL testing. I’m creating a complete series on this topic including some interesting…

Bug bounty hunting has a funny way of turning something that looks completely ordinary into something much more interesting.

If you’ve not already gone through the previous article that goes through the basics in detail, I would highly recommend going through it…

A Broken Access Control vulnerability where changing a single userId allowed an authenticated user to modify another user’s notification…

TL;DR A Twenty CRM vulnerability, CVE-2026-105763, let any workspace member read other members’ IMAP, SMTP and CalDAV passwords in plaintext. The flaw scores 9.6 on CVSS and needs only the d…

GraphQL shifts a lot of power to the client. One endpoint, one POST request, and the caller decides exactly which objects and fields come…

The lab’s rate limit can be bypassed by batching multiple login operations into one GraphQL request using aliases, rather than sending each…

video and github link

This labs takes my time because i stuck in that URL encode part so lets starts how i solved this lab.