Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.4

API Platform Core may skip post-resolver security check

CVE-2025-23204 · published 1 year ago
Summary

The API Platform Core library version 3.3.8 and later can replace a security check that should run after a GraphQL query with a different check, effectively ignoring the intended restriction. This means that any custom security rule meant to be applied after the query may not be enforced, potentially exposing data. Upgrade to version 3.3.15 or later to restore the correct security behavior.

What to do
  • Update api-platform core to version 3.3.15.
Affected software
Ecosystem VendorProductAffected versions
composer api-platform core >= 3.3.8, < 3.3.15
Fix: upgrade to 3.3.15
Original advisory text
GraphQl securityAfterResolver not called
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As this falls back to `security`, the impact is there only when there's only a security after resolver and none inside security. Version 3.3.15 contains a patch for the issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
CWE-484Omitted Break Statement in Switch
Timeline
Published24 Mar 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-7mxx-3cgm-xxv3 · GHSA
CVE-2025-23204 · NVD
CVE-2025-23204 · OSV
Track software like this
Free during beta