{"action":"Upgrade @apollo/composition to 2.9.5 or later.","affected":[{"fixed":"2.9.5","introduced":"0"},{"fixed":"2.10.4","introduced":"2.10.0-alpha.3"},{"fixed":"2.11.5","introduced":"2.11.0-preview.1"},{"fixed":"2.12.1","introduced":"2.12.0-preview.0"}],"component":"@apollo/composition","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2.9.5","2.10.4","2.11.5","2.12.1"],"ghsa_id":"GHSA-m8jr-fxqx-8xx6","id":"tcs_01M5KG05RKW0AQDE0B9RMVE7T9","modified_at":"2025-11-14T21:50:07Z","published_at":"2025-11-14T21:49:26Z","references":["https://osv.dev/vulnerability/GHSA-m8jr-fxqx-8xx6","https://github.com/apollographql/federation/security/advisories/GHSA-m8jr-fxqx-8xx6","https://github.com/apollographql/federation/commit/09e596e6a0c753071ca822e84f525d73ada395cf","https://github.com/apollographql/federation/commit/0d8fca1c8cc375bb8486f11f339984b69267417d","https://github.com/apollographql/federation/commit/20c75d1d60a48fc289d88c8d29652f1afc7553e4","https://github.com/apollographql/federation/commit/e1c58611c3c996b4fff98a54e49f00549ff2115d","https://github.com/apollographql/federation"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-m8jr-fxqx-8xx6","url":"https://osv.dev/vulnerability/GHSA-m8jr-fxqx-8xx6"}],"summary":"Apollo Federation has Improper Enforcement of Access Control on Transitive Fields"}