CVE-2025-59845 - CVE House
Back to Database
Status published High CVE-2025-59845

Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass

Vulnerability Description

Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery (CSRF) vulnerability was identified. The vulnerability arises from missing origin validation in the client-side code that handles window.postMessage events. A malicious website can send forged messages to the embedding page, causing the victim’s browser to execute arbitrary GraphQL queries or mutations against their GraphQL server while authenticated with the victim’s cookies. This issue has been patched in Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59845

Credits & Attribution

No credits recorded in the NVD database.

References

More from apollographql

View All →
CVE-2025-64530
@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields
High 7.5
CVE-2025-64347
Apollo Router Improperly Enforces Renamed Access Control Directives
High 7.5
CVE-2025-64173
Apollo Router Core: Access Control Bypass on Polymorphic Types
High 7.5
CVE-2025-32380
Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing
High 7.5
CVE-2025-32034
Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion
High 7.5

Affected Vendor

apollographql

View all reports →

Affected Software

embeddable-explorer
Vulnerable Versions:
< 2.7.2, < 3.7.3

Timeline

Official Publish: September 26th, 2025
Last Modified: September 29th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Weaknesses (CWE)

CWE-346 CWE-352

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1565.002 Stored Data Manipulation
Impact
T1566.002 Spearphishing Link
Initial Access
T1204.001 Malicious Link
Execution
T1098 Account Manipulation
Persistence
T1565.001 Stored Data Manipulation
Impact