Four new graphql advisories

gems/graphql/GHSA-4rw8-495r-pf6j.yml

@@ -0,0 +1,23 @@
+---
+gem: graphql
+ghsa: 4rw8-495r-pf6j
+url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-4rw8-495r-pf6j
+title: Execution::Next renders objects whose authorized? check failed
+date: 2026-10-29
+description: |
+  In some cases, GraphQL::Execution::Next rendered results for objects
+  whose .authorized? hooks indicated that the object was unauthorized.
+cvss_v3: 7.5
+unaffected_versions:
+  - "< 2.5.20"
+patched_versions:
+  - ">= 2.6.14"
+related:
+  url:
+    - https://rubygems.org/gems/graphql/versions/2.6.14
+    - https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#2614-29-oct-2026
+    - https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-4rw8-495r-pf6j
+notes: |
+  - No CVE from GHSA URL.
+  - cvss_V3 from GHSA URL
+  - NOTE: gem name is "graphql" and repo name is "graphql-ruby".

gems/graphql/GHSA-965v-9v76-5hg2.yml

@@ -0,0 +1,30 @@
+---
+gem: graphql
+ghsa: 965v-9v76-5hg2
+url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-965v-9v76-5hg2
+title: Execution::Next reuses Relay scoped authorization for
+  unrelated child fields, disclosing protected data
+date: 2026-10-14
+description: |
+  Starting in GraphQL-Ruby 2.5.21, when using Execution::Next, connection
+  fields whose type implemented def self.scoped(...) and used
+  reauthorize_scoped_objects(false) would wrongly skip authorization
+  on extra fields attached to the connections *Edge type.
+
+  Schemas that don't use Execution::Next are not affected. Connections
+  that don't use def self.scoped and reauthorize_scoped_objects(false)
+  are not affected. Edge types that don't have extra, application-specific
+  fields are not affected.
+unaffected_versions:
+  - "< 2.5.21"
+patched_versions:
+  - ">= 2.6.12"
+related:
+  url:
+    - https://rubygems.org/gems/graphql/versions/2.6.12
+    - https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#2612-14-oct-2026
+    - https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-965v-9v76-5hg2
+notes: |
+  - No CVE from GHSA URL.
+  - "High" Severity in GHSA URL
+  - NOTE: gem name is "graphql" and repo name is "graphql-ruby".

gems/graphql/GHSA-p3g2-4c7r-4fww.yml

@@ -0,0 +1,28 @@
+---
+gem: graphql
+ghsa: p3g2-4c7r-4fww
+url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-p3g2-4c7r-4fww
+title: Wrong type can be loaded from ID when `loads:` is an Object
+  and not used elsewhere in the schema
+date: 2026-09-21
+description: |
+  When an argument uses loads: and references an Object type which
+  is not used as a return type of any fields in the schema (or as a
+  member of an Interface or Union type which is returned by the schema),
+  GraphQL-Ruby didn't properly check that the application object
+  loaded from the provided ID was resolved to the same type referenced
+  by loads:.
+unaffected_versions:
+  - "< 2.1.2"
+patched_versions:
+  - ">= 2.6.11"
+related:
+  url:
+    - https://rubygems.org/gems/graphql/versions/2.6.11
+    - https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#2611-21-sep-2026
+    - https://github.com/rmosolgo/graphql-ruby/pull/5745
+    - https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-p3g2-4c7r-4fww
+notes: |
+  - No CVE from GHSA URL.
+  - "High" Severity in GHSA URL
+  - NOTE: gem name is "graphql" and repo name is "graphql-ruby".

gems/graphql/GHSA-q3cc-p5hm-55wj.yml

@@ -0,0 +1,26 @@
+---
+gem: graphql
+ghsa: q3cc-p5hm-55wj
+url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q3cc-p5hm-55wj
+title: Interpreter runtime renders results from objects whose
+  `.authorized?` checks had failed
+date: 2026-10-29
+description: |
+  The legacy interpreter (Execution::Interpreter) renders the original,
+  unauthorized object when authorized? raises GraphQL::UnauthorizedError
+  and Schema.unauthorized_object returns a replacement.
+  Returning false correctly renders the replacement.
+cvss_v3: 6.5
+unaffected_versions:
+  - "< 1.10.0"
+patched_versions:
+  - ">= 2.6.14"
+related:
+  url:
+    - https://rubygems.org/gems/graphql/versions/2.6.14
+    - https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#2614-29-oct-2026
+    - https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q3cc-p5hm-55wj
+notes: |
+  - No CVE from GHSA URL.
+  - cvss_V3 from GHSA URL
+  - NOTE: gem name is "graphql" and repo name is "graphql-ruby".