CVE-2025-31485 Details
Description
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17.
A vulnerability exists in API Platform Core's GraphQL implementation, specifically in versions prior to 4.0.22 and 3.4.16. The issue arises because security grants on properties can be cached with different objects, leading to incorrect access permissions. The problem is rooted in the ItemNormalizer's caching mechanism, which fails to properly account for variations in object instances. As a result, properties may be exposed or restricted incorrectly, depending on the cached context.
Users can update to API Platform Core versions 4.0.22 or 3.4.17, both of which include the necessary fix. Instructions for updating can be found in the API Platform documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 3, 2025CISA-ADP
Assessed Apr 3, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8 | [email protected] | Source CodeVendor |
| https://github.com/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a | [email protected] | Source CodeVendor |
| https://github.com/api-platform/core/releases/tag/v3.4.17 | [email protected] | Release NotesVendor |
| https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-696 | Incorrect Behavior Order | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| api-platform/core | < 4.0.22 (semver) < 3.4.17 (semver) |
CPE
Remediation
| |
| api-platform/graphql | All versions |
CPE
Remediation
| |
| api-platform/tests/Fixtures/TestBundle/Document/SecuredDummyCollection | All versions |
CPE
Remediation
| |
| api-platform/tests/Fixtures/TestBundle/Document/SecuredDummyCollectionParent | All versions |
CPE
Remediation
| |
| api-platform/tests/Fixtures/TestBundle/Entity/SecuredDummyCollection | All versions |
CPE
Remediation
| |
| api-platform/tests/Fixtures/TestBundle/Entity/SecuredDummyCollectionParent | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 8, 2025 | CVE Modified | [email protected] |
| Apr 3, 2025 | New CVE Received | [email protected] |