Custom graphql Query to unauthorized user

enable the right permissions in the users&permissions plugin in strapi itself.