CVE-2025-23204 - CVE House
Back to Database
Status published Medium CVE-2025-23204

GraphQl securityAfterResolver not called

Vulnerability Description

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As this falls back to `security`, the impact is there only when there's only a security after resolver and none inside security. Version 3.3.15 contains a patch for the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-23204

Credits & Attribution

No credits recorded in the NVD database.

References

More from api-platform

View All →
CVE-2025-31485
GraphQL grant on a property might be cached with different objects
High 7.5
CVE-2025-31481
GraphQL query operations security can be bypassed
High 7.5
CVE-2023-47639
API Platform Core can leak exceptions message that may contain sensitive information
Medium 5.3
CVE-2023-25575
Secured properties in API Platform Core may be accessible within collections
High 7.7
CVE-2019-1000011
API Platform version from 2.2.0 to 2.3.5 contains an Incorrect...
Medium 6.5

Affected Vendor

api-platform

View all reports →

Affected Software

core
Vulnerable Versions:
>= 3.3.8, < 3.3.15

Timeline

Official Publish: March 24th, 2025
Last Modified: March 24th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-20

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact