{
  "category": "api",
  "vuln_class": "GraphQL introspection + BOLA",
  "title": "Introspection-leaked schema reveals admin-only fields callable by regular user",
  "user": "Discovered /graphql endpoint accepts POST application/json. Sent the standard introspection query and received the full schema. Among the surfaced types: a `User` type with fields `email`, `phoneNumber`, `internalNotes`, and a `Query.user(id: ID!): User` resolver that takes any user ID.",
  "assistant": "RECON: introspection is enabled in what appears to be production. The schema exposes a Query.user(id: ID!) resolver that takes any ID and returns the User type — including fields that look administrative (internalNotes) or PII-grade (email, phoneNumber).\n\nHYPOTHESIS: two compounding issues.\n(a) Introspection-in-production is information disclosure (medium).\n(b) The real bug, likely worth the bounty: Query.user(id: $id) probably lacks authorization. The schema lets any authenticated caller request any user by ID. If the resolver enforces no per-field auth, this is BOLA + PII exposure.\n\nTEST:\n1. With user_A's session, POST { query: \"{ user(id: \\\"<user_B's id>\\\") { email phoneNumber internalNotes } }\" }.\n2. If the response returns user_B's email/phone/notes, BOLA is confirmed.\n3. Try a tenant-boundary jump too: enumerate IDs across a known organizational gap to see if cross-tenant access is also possible.\n\nINDICATOR: response data contains another user's PII without an authorization error.\n\nNotes for follow-up exploration triggered by the schema:\n- Look for mutations like updateUser / deleteUser that may also be unauthorized.\n- Field-suggestion leak: send malformed queries to see if the error includes \"did you mean...\" hints that reveal more fields than introspection showed.\n- Test alias-based BOLA: ask for many users in one query via aliases — sometimes per-call rate-limits don't apply to aliased fields in a single document.\n- GraphQL depth/complexity DoS is a separate ticket — record but don't trigger.\n\nReport the introspection-in-prod finding regardless (low/medium), and the BOLA separately as critical if confirmed."
}