CVE-2025-31481

Published: Apr 3, 2025Modified: Apr 8, 2025

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (4)

https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb

Source: security-advisories@github.com

https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568

Source: security-advisories@github.com

https://github.com/api-platform/core/releases/tag/v3.4.17

Source: security-advisories@github.com

https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m

Source: security-advisories@github.com

Timeline

No history available yet.