CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2025-64347
High (7.5). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in apollo-router 1.61.12, 2.8.1.
Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives (@authenticated, @requiresScopes, and @policy) that were renamed via @link imports. Router did not enforce renamed access control directives on schema elements (e.g. fields and types), allowing queries to bypass those element-level access controls. This issue is fixed in versions 1.61.12 and 2.8.1.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
- CWE
- CWE-284
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-g8jh-vg5j-4h3f | crates.io | apollo-router | <1.61.12 | 1.61.12 |
| GHSA-g8jh-vg5j-4h3f | crates.io | apollo-router | >=2.0.0-alpha.0 <2.8.1 | 2.8.1 |