{"uuid": "37db94ea-8eb1-4915-8319-792d39693f3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19478", "type": "seen", "source": "https://bsky.app/profile/alejandxr.bsky.social/post/3mtfimg6u3z2c", "content": "GraphQL decouples auth from routing. Checking permissions only in your global HTTP middleware is a trap\u2014if one resolver lacks a check, you leak data.\n\nGitLab's CVE-2026-19478 (CVSS 9.4) is exactly this: unauthenticated project deletion via a bypassed resolver.", "creation_timestamp": "2026-08-19T00:40:02.165268Z"}