Back to Database
Status published
High
CVE-2025-31481
GraphQL query operations security can be bypassed
Vulnerability Description
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-31481
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m
- https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb
- https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568
- https://github.com/api-platform/core/releases/tag/v3.4.17
More from api-platform
View All →CVE-2025-31485
GraphQL grant on a property might be cached with different objects
High
7.5
CVE-2025-23204
GraphQl securityAfterResolver not called
Medium
4.4
CVE-2023-47639
API Platform Core can leak exceptions message that may contain sensitive information
Medium
5.3
CVE-2023-25575
Secured properties in API Platform Core may be accessible within collections
High
7.7
CVE-2019-1000011
API Platform version from 2.2.0 to 2.3.5 contains an Incorrect...
Medium
6.5
Affected Vendor
api-platform
View all reports →Affected Software
core
Vulnerable Versions:
>= 4.0.0, < 4.0.22, < 3.4.17
Timeline
Official Publish:
April 3rd, 2025
Last Modified:
April 8th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N