CVE-2025-31481highCWE-863

CVE-2025-31481: high-severity vulnerability in api-platform core

GraphQL query operations security can be bypassed

Published · Updated

Follow this CVE+ Monitor core+ Monitor api-platform/core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.5%
In short

A flaw in API Platform Core allows attackers to bypass security rules on GraphQL operations by exploiting the Relay node type feature. This means unauthorized users could perform restricted actions they shouldn't be able to.

Technical detail

The vulnerability exists in API Platform Core's handling of Relay special node types in GraphQL queries, allowing attackers to circumvent configured operation-level security policies. By crafting specially formed queries targeting the Relay node interface, an unauthenticated or unauthorized user can execute restricted operations that should be protected by access control rules.

Summary generated and translated by AI from the official description.
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
api-platform · core
Related CVEs — api-platform core

In the same product, most dangerous first.

CVE-2025-31485HIGHGraphQL grant on a property might be cached with different objectsEPSS 0.6%CVE-2023-25575HIGHSecured properties in API Platform Core may be accessible within collectionsEPSS 0.6%CVE-2023-47639MEDIUMAPI Platform Core can leak exceptions message that may contain sensitive informationEPSS 0.4%CVE-2026-54164MEDIUMAPI Platform Core: Missing IRI type check enables resource type confusionEPSS 0.3%CVE-2026-49858MEDIUMAPI Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gateEPSS 0.3%CVE-2025-23204MEDIUMGraphQl securityAfterResolver not calledEPSS 0.3%