The GraphQL endpoint returns detailed error messages in response to malformed or unexpected queries. Verbose GraphQL errors can expose internal implementation details such as resolver names, type information, stack traces, or database query fragments, which assist attackers in refining their attacks.

Impacts:

• Disclosure of internal type and resolver names
• Exposure of backend implementation details
• Assists in crafting targeted injection and data extraction queries

Recommendation:

• Configure the GraphQL server to return generic error messages in production
• Log detailed errors server-side only
• Avoid exposing stack traces or internal resolver paths in responses

• GraphQL Error Handling
• GraphQL Cheat Sheet