Critical Vulnerability in Hasura GraphQL Engine v2.10.0-v2.15

Introduction On November 21st, Hasura became aware of a critical security vulnerability within our GraphQL Engine “Update Many” API, which was introduced in version 2.10.0. The vulnerability was identified by Morten Hillbom and Issaaf Kattan from Nhost's customer company Celsia.io. There was a Missing Authorization vulnerability which allowed some expansion of update capabilities of a user. This…

This is an excerpt. The full article continues at Hasura.