Vulnerability-Lookup

CVE-2025-31481 (GCVE-0-2025-31481)

Vulnerability from cvelistv5 – Published: 2025-04-03 19:20 – Updated: 2025-04-08 13:14

Title

GraphQL query operations security can be bypassed

Summary

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/api-platform/core/security/adv…	x_refsource_CONFIRM
https://github.com/api-platform/core/commit/55712…	x_refsource_MISC
https://github.com/api-platform/core/commit/60747…	x_refsource_MISC
https://github.com/api-platform/core/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
api-platform	core	Affected: >= 4.0.0, < 4.0.22 Affected: < 3.4.17

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-31481",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-03T19:39:57.000917Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-03T19:40:10.582Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "api-platform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.22"
            },
            {
              "status": "affected",
              "version": "\u003c 3.4.17"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T13:14:36.379Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m"
        },
        {
          "name": "https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb"
        },
        {
          "name": "https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568"
        },
        {
          "name": "https://github.com/api-platform/core/releases/tag/v3.4.17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/api-platform/core/releases/tag/v3.4.17"
        }
      ],
      "source": {
        "advisory": "GHSA-cg3c-245w-728m",
        "discovery": "UNKNOWN"
      },
      "title": "GraphQL query operations security can be bypassed"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-31481",
    "datePublished": "2025-04-03T19:20:22.916Z",
    "dateReserved": "2025-03-28T13:36:51.297Z",
    "dateUpdated": "2025-04-08T13:14:36.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-31481",
      "date": "2026-05-26",
      "epss": "0.0014",
      "percentile": "0.33664"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-31481\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-04-03T20:15:25.543\",\"lastModified\":\"2025-04-08T14:15:35.067\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.\"},{\"lang\":\"es\",\"value\":\"API Platform Core es un sistema para crear API REST y GraphQL basadas en hipermedia. Mediante el tipo de nodo especial Relay, se puede eludir la seguridad configurada en una operaci\u00f3n. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 4.0.22.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"references\":[{\"url\":\"https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/api-platform/core/releases/tag/v3.4.17\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-31481\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-03T19:39:57.000917Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-03T19:40:00.484Z\"}}], \"cna\": {\"title\": \"GraphQL query operations security can be bypassed\", \"source\": {\"advisory\": \"GHSA-cg3c-245w-728m\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"api-platform\", \"product\": \"core\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 4.0.0, \u003c 4.0.22\"}, {\"status\": \"affected\", \"version\": \"\u003c 3.4.17\"}]}], \"references\": [{\"url\": \"https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m\", \"name\": \"https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb\", \"name\": \"https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568\", \"name\": \"https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/api-platform/core/releases/tag/v3.4.17\", \"name\": \"https://github.com/api-platform/core/releases/tag/v3.4.17\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863: Incorrect Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-04-08T13:14:36.379Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-31481\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-08T13:14:36.379Z\", \"dateReserved\": \"2025-03-28T13:36:51.297Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-04-03T19:20:22.916Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-31481

Vulnerability from fkie_nvd - Published: 2025-04-03 20:15 - Updated: 2026-04-15 00:35

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb
	security-advisories@github.com	https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568
	security-advisories@github.com	https://github.com/api-platform/core/releases/tag/v3.4.17
	security-advisories@github.com	https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17."
    },
    {
      "lang": "es",
      "value": "API Platform Core es un sistema para crear API REST y GraphQL basadas en hipermedia. Mediante el tipo de nodo especial Relay, se puede eludir la seguridad configurada en una operaci\u00f3n. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 4.0.22."
    }
  ],
  "id": "CVE-2025-31481",
  "lastModified": "2026-04-15T00:35:42.020",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-04-03T20:15:25.543",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/api-platform/core/releases/tag/v3.4.17"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-CG3C-245W-728M

Vulnerability from github – Published: 2025-04-04 14:07 – Updated: 2025-08-29 21:07

Summary

GraphQL query operations security can be bypassed

Details

Summary

Using the Relay special node type you can bypass the configured security on an operation.

Details

Here is an example of how to apply security configurations for the GraphQL operations:

#[ApiResource(
    security: "is_granted('ROLE_USER')",
    operations: [ /* ... */ ],
    graphQlOperations: [
        new Query(security: "is_granted('ROLE_USER')"),
        //...
    ],
)]
class Book { /* ... */ }

This indeed checks is_granted('ROLE_USER') as expected for a GraphQL query like the following:

‌query {
    book(id: "/books/1") {
        title
    }
}

But the security check can be bypassed by using the node field (that is available by default) on the root query type like that:

‌query {
    node(id: "/books/1") {
        ... on Book {
            title
        }
    }
}

This does not execute any security checks and can therefore be used to access any entity without restrictions by everyone that has access to the API.

Impact

Everyone using GraphQl with the security attribute. Not sure whereas this works with custom resolvers nor if this also applies on mutation.

Patched at https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "api-platform/graphql"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0-alpha.1"
            },
            {
              "fixed": "4.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "api-platform/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0-alpha.1"
            },
            {
              "fixed": "4.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "api-platform/graphql"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "api-platform/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "api-platform/graphql"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0-alpha.1"
            },
            {
              "fixed": "4.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "api-platform/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0-alpha.1"
            },
            {
              "fixed": "4.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-31481"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-04T14:07:20Z",
    "nvd_published_at": "2025-04-03T20:15:25Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nUsing the Relay special `node` type you can bypass the configured security on an operation.\n\n### Details\n\nHere is an example of how to apply security configurations for the GraphQL operations:\n\n```php\n#[ApiResource(\n    security: \"is_granted(\u0027ROLE_USER\u0027)\",\n    operations: [ /* ... */ ],\n    graphQlOperations: [\n        new Query(security: \"is_granted(\u0027ROLE_USER\u0027)\"),\n        //...\n    ],\n)]\nclass Book { /* ... */ }\n```\n\nThis indeed checks `is_granted(\u0027ROLE_USER\u0027)` as expected for a GraphQL query like the following:\n\n```php\n\u200cquery {\n    book(id: \"/books/1\") {\n        title\n    }\n}\n```\n\nBut the security check can be bypassed by using the `node` field (that is available by default) on the root query type like that:\n\n```php\n\u200cquery {\n    node(id: \"/books/1\") {\n        ... on Book {\n            title\n        }\n    }\n}\n```\n\nThis does not execute any security checks and can therefore be used to access any entity without restrictions by everyone that has access to the API.\n\n### Impact\n\nEveryone using GraphQl with the `security` attribute. Not sure whereas this works with custom resolvers nor if this also applies on mutation.\n\nPatched at https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568",
  "id": "GHSA-cg3c-245w-728m",
  "modified": "2025-08-29T21:07:09Z",
  "published": "2025-04-04T14:07:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31481"
    },
    {
      "type": "WEB",
      "url": "https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31481.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31481.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/api-platform/core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/api-platform/core/releases/tag/v3.4.17"
    },
    {
      "type": "WEB",
      "url": "https://github.com/api-platform/core/releases/tag/v4.1.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "GraphQL query operations security can be bypassed"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-31481 (GCVE-0-2025-31481)

FKIE_CVE-2025-31481

GHSA-CG3C-245W-728M

Summary

Details

Impact

Tags

Sightings

Nomenclature