graphql-idor-via-introspection-leak

Finding GraphQL IDOR vulnerabilities involves leveraging schema introspection to discover queries and mutations, then systematically probing resolvers for missing ownership checks on ID parameters to confirm unauthorized cross-user data access.

A GraphQL IDOR via introspection is an object-level authorization bypass where schema introspection reveals hidden fields or mutations. Attackers use arbitrary IDs on unsecured resolvers to access or modify another user's data.

GraphQL introspection exposes authorization risks by mapping the schema structure to reveal hidden queries and mutations. When resolvers lack authorization checks, attackers identify vulnerable ID arguments to exploit unauthorized cross-user data access.

Yes, you can detect missing resolver authorization checks by analyzing schema structure and ID argument types obtained via introspection. Probing these parameters with arbitrary IDs confirms missing object-level authorization.

A key limitation is that this approach requires introspection to be enabled on the GraphQL API endpoint. If introspection is disabled, you cannot automatically map the schema to identify vulnerable query and mutation parameters.