GHSA-gj2p-p9m4-c8gw: Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

Craft CMS has a security flaw in its GraphQL Address resolver that fails to properly filter which addresses a user can access. A GraphQL API token (a credential that grants limited access to the API) scoped to read only one user group can retrieve addresses from all user groups, exposing sensitive personal information like names, addresses, tax IDs, and organization details that should be hidden from that token.