What is the Salesforce GraphQL Exploit and What You Should Do

Attackers are exploiting misconfigured Salesforce Experience Cloud guest user permissions via a modified version of AuraInspector to query and extract data through Salesforce's GraphQL interface at scale. This is not a new platform vulnerability but a more sophisticated exploitation of long-known overly permissive guest user configurations. Harvested data (names, contact details) is used to fuel vishing campaigns that can escalate into full SaaS compromise. Key remediation steps include auditing guest user profiles, setting org-wide sharing defaults to Private for external users, disabling public API access for guest users, and disabling self-registration where not needed. AppOmni has deployed new threat detection rules targeting this GraphQL attack variant and is notifying affected customers.