CVE-2025-31481 | THREATINT

Description

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.

PUBLISHED Reserved 2025-03-28 | Published 2025-04-03 | Updated 2025-04-08 | Assigner GitHub_M

HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-863: Incorrect Authorization

Product status

>= 4.0.0, < 4.0.22

affected

< 3.4.17

affected

References

github.com/...m/core/security/advisories/GHSA-cg3c-245w-728m

github.com/...ommit/55712452b4f630978537bdb2a07dc958202336bb

github.com/...ommit/60747cc8c2fb855798c923b5537888f8d0969568

github.com/api-platform/core/releases/tag/v3.4.17

cve.org (CVE-2025-31481)

nvd.nist.gov (CVE-2025-31481)

Download JSON