CVE-2025-23204mediumCWE-20

CVE-2025-23204: medium-severity vulnerability in api-platform core

GraphQl securityAfterResolver not called

Published

Follow this CVE+ Monitor core+ Monitor api-platform/core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.4epss 0.3%
In short

A security check in GraphQL APIs is being skipped due to a missing break statement, allowing requests that should be denied to pass through when certain security conditions are set.

Technical detail

A control flow vulnerability in API Platform Core (v3.3.8+) causes the securityAfterResolver check to be overwritten without a break statement in a switch/conditional clause. This impacts authorization enforcement only when security rules are defined exclusively in the afterResolver hook without corresponding security constraints in the main security layer, potentially allowing unauthorized access to protected resolvers.

Summary generated and translated by AI from the official description.
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As this falls back to `security`, the impact is there only when there's only a security after resolver and none inside security. Version 3.3.15 contains a patch for the issue.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Affected products
api-platform · core
Related CVEs — api-platform core

In the same product, most dangerous first.

CVE-2025-31485HIGHGraphQL grant on a property might be cached with different objectsEPSS 0.6%CVE-2023-25575HIGHSecured properties in API Platform Core may be accessible within collectionsEPSS 0.6%CVE-2025-31481HIGHGraphQL query operations security can be bypassedEPSS 0.5%CVE-2023-47639MEDIUMAPI Platform Core can leak exceptions message that may contain sensitive informationEPSS 0.4%CVE-2026-54164MEDIUMAPI Platform Core: Missing IRI type check enables resource type confusionEPSS 0.3%CVE-2026-49858MEDIUMAPI Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gateEPSS 0.3%