CVE-2025-59845
Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery (CSRF) vulnerability was identified. The vulnerability arises from missing origin validation in the client-side code that handles window.postMessage events. A malicious website can send forged messages to the embedding page, causing the victim’s browser to execute arbitrary GraphQL queries or mutations against their GraphQL server while authenticated with the victim’s cookies. This issue has been patched in Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.2
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
- EPSS probability
- 0.16%
- CWE
- CWE-346, CWE-352
- Published
- 2025-09-26
- Last modified
- 2026-03-13
Affected products
- apollographql embeddable-explorer
- apollographql embeddable-explorer
Weakness type
Related vulnerabilities
- CVE-2026-87563 — Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...
- CVE-2026-58649 — .NET Information Disclosure Vulnerability
- CVE-2026-69559 — Microsoft Teams for Android Information Disclosure Vulnerability
- CVE-2026-69680 — Windows DNS Spoofing Vulnerability
- CVE-2026-75156 — Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
- CVE-2026-85152 — undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
- CVE-2026-84482 — WWBN AVideo Cross-Site Request Forgery via get_domain() validation
- CVE-2026-82811 — Toggl OÜ Toggl Track Extension postMessage origin validation