CVE-2025-64172

Apollo Federation has Improper Enforcement of Access Control on Transitive Fields. A vulnerability in Apollo Federation's composition logic did not enforce that fields depending on protected data through `@requires` and/or `@fromContext` directives have the same access control requirements as the fields they reference. This allowed queries to access protected fields indirectly through their dependencies, bypassing access control checks. A fix to composition logic in Federation now enforces that dependent fields match the access control requirements from of the fields they reference. Specifically, Apollo Router does not enforce access control requirements on transitively-accessed fields, and Apollo Federation did not require that fields using `@requires` or `@fromContext` have the same access control as the fields they depend on. At execution time, when a field decorated with `@requires` or `@fromContext` was resolved, the Router would fetch the required dependency fields from subgraphs...