CVE-2023-28877

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-31 · updated 2026-06-17
Weakness: CWE-284

Description

The VTEX apps-graphql@2.x GraphQL API module does not properly restrict unauthorized access to private configuration data. (apps-graphql@3.x is unaffected by this issue.)

Affected products

Vtex Apps-Graphql: 2.x

References

https://developers.vtex.com/updates/release-notes/deprecation-of-apps-graphql%402.x
https://developers.vtex.com/updates/release-notes/deprecation-of-apps-graphql%402.x

Get alerted when CVE-2023-28877 or the next vulnerability affects your stack