CVE-2019-1000011 - CVE House
Back to Database
Status published Medium CVE-2019-1000011

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect...

Vulnerability Description

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-1000011

Credits & Attribution

No credits recorded in the NVD database.

References

More from api-platform

View All →
CVE-2025-31485
GraphQL grant on a property might be cached with different objects
High 7.5
CVE-2025-31481
GraphQL query operations security can be bypassed
High 7.5
CVE-2025-23204
GraphQl securityAfterResolver not called
Medium 4.4
CVE-2023-47639
API Platform Core can leak exceptions message that may contain sensitive information
Medium 5.3
CVE-2023-25575
Secured properties in API Platform Core may be accessible within collections
High 7.7

Affected Vendor

api-platform

View all reports →

Affected Software

core
Vulnerable Versions:
2.2.0

Timeline

Official Publish: February 4th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.