GHSA-xpg7-m6gm-4xfh: 
PHP vulnerability analysis and mitigation

Anonymous GraphQL clients can read out-of-scope section content via prev/next.

Preconditions

• GraphQL API enabled with a public schema, or any scoped private token.
• The schema grants read on at least one section and withholds at least one other.
• One visible in-scope entry; the attacker reads its id from the root query, in band.
• The two sections share an entry type, so the withheld entry’s GraphQL object type exists in the schema, and the response serializes.
• Not required: allowAdminChanges, devMode, an account, an elevated session, or any config

Impact

An anonymous internet client holding only the endpoint URL — no account, no cookie, no CSRF token — reads the title, slug, uid, post date, and full custom-field content of entries in sections the operator deliberately excluded from the public GraphQL schema’s read scope, and enumerates the site’s entire entry list by chaining next{next{…}} hops from one visible entry. On a headless or partially exposed install, the schema scope is the only boundary protecting that content. Report ID: 1933