Skip to content
OpenAdvisories

Vendor

api-platform

7 known vulnerabilities.

Products

core 7 api-platform/hal 1 api-platform/json-api 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2025-31485

    GraphQL grant on a property might be cached with different objects

    API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is me…

    api-platform core api-platform/core api-platform/graphql Packagist
  • High 7.5
    CVE-2025-31481

    GraphQL query operations security can be bypassed

    API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.

    api-platform core api-platform/core api-platform/graphql Packagist
  • High 7.7
    CVE-2023-25575

    Secured properties in API Platform Core may be accessible within collections

    API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs. Resource properties secured with the `security` option of the `ApiPlatform\Metadata\ApiProperty` attribute can be disclosed to unauthorized users. The problem affects most…

    api-platform core api-platform/core Packagist