CVE-2025-31485highCWE-696

CVE-2025-31485: high-severity vulnerability in api-platform core

GraphQL grant on a property might be cached with different objects

Published · Updated

Follow this CVE+ Monitor core+ Monitor api-platform/core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.6%
In short

API Platform Core has a caching bug where GraphQL permission checks on properties can be incorrectly reused for different objects, potentially allowing unauthorized access to data that should be restricted.

Technical detail

The ItemNormalizer::isCacheKeySafe() method fails to prevent cache key generation for GraphQL field-level authorization checks; the parent normalize() method still creates the cache entry, causing permission decisions from one object to be applied to another object in subsequent requests.

Summary generated and translated by AI from the official description.
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
api-platform · core
Related CVEs — api-platform core

In the same product, most dangerous first.

CVE-2023-25575HIGHSecured properties in API Platform Core may be accessible within collectionsEPSS 0.6%CVE-2025-31481HIGHGraphQL query operations security can be bypassedEPSS 0.5%CVE-2023-47639MEDIUMAPI Platform Core can leak exceptions message that may contain sensitive informationEPSS 0.4%CVE-2026-54164MEDIUMAPI Platform Core: Missing IRI type check enables resource type confusionEPSS 0.3%CVE-2026-49858MEDIUMAPI Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gateEPSS 0.3%CVE-2025-23204MEDIUMGraphQl securityAfterResolver not calledEPSS 0.3%