WPGraphQL

Security Notices
WPGraphQL 2.22.2 Restores Post Capability Enforcement

WPGraphQL's updatePost mutation can let Contributors publish their own drafts or alter their published posts without required capabilities. Update to 2.22.2 and review post history; successful installation does not prove earlier changes were authorized.

Read this guide