The GraphQL endpoint has introspection enabled. Introspection allows any client to query the full schema, including all types, fields, queries, mutations, and subscriptions. In production environments this exposes the entire API surface to attackers, enabling targeted data extraction and facilitating other attacks.

Impacts:

• Full disclosure of internal data model and relationships
• Enumeration of sensitive fields and types not visible in documentation
• Facilitates targeted injection and authorization bypass attacks
• Assists attackers in crafting precise exploitation queries

Recommendation:

• Disable introspection in production environments
• If introspection is required, restrict access to authenticated and authorized users only
• Use schema masking or depth-limiting middleware

• Disable introspection in production
• GraphQL Cheat Sheet