Subscriber Privilege Escalation in Gato GraphQL <= 19.2.3 versions.
Subscriber Privilege Escalation in Gato GraphQL <= 19.2.3 versions.
- Severity
- HighCVSS 3.1 · 8.8 · Patchstack
- Fix
- Fixed in 19.2.4Fix recorded today
- Affected versions
- through 19.2.3
- Weakness
- CWE-266
- Affects
- Gato GraphQL
- Exploited
- Not confirmedNo confirmation recorded
- CISA SSVC
- No known exploitationAutomatable: no · Technical impact: total
- EU ID
- EUVD-2026-76196ENISA vulnerability database
What to do
Update to 19.2.4 or later.
Severity breakdown
- Attack vector Network Requires network access to the vulnerable service
- Attack complexity Low Low complexity under the assessed conditions
- Privileges required Low Attacker needs a basic user account
- User interaction None No victim action needed
- Scope Unchanged Impact stays within the same security authority
- Confidentiality impact High Sensitive data can be exposed with serious impact
- Integrity impact High Protected data can be changed with serious impact
- Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator