Skip to content
Heist/ feed
Back to feed
High

GraphQL query operations security can be bypassed

Type: advisorySources: OSV

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-31481
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 18:24 UTC · Revision 1

Source evidence

GraphQL query operations security can be bypassed

core-osv · Original source

Published 3 Apr 2025, 19:20 UTC

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.

osv:CVE-2025-31481
Complete source record
{
  "id": "927be695ffeceeccf04eb18857aedb0c5a28153c543d253ab875c188121a32bc",
  "url": "https://osv.dev/vulnerability/CVE-2025-31481",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "GraphQL query operations security can be bypassed",
    "summary": "API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.",
    "evidence": "osv:CVE-2025-31481",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2025-31481",
      "aliases": [
        "CVE-2025-31481",
        "GHSA-cg3c-245w-728m"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/api-platform/core",
              "type": "GIT",
              "events": [
                {
                  "introduced": "825833cfee432e6b0988882d019b4fe4a03f63d5"
                },
                {
                  "fixed": "8de9bf87f20a31f74102247cb8d75583797c6593"
                },
                {
                  "introduced": "0"
                },
                {
                  "fixed": "c5fb664d17ed9ae919394514ea69a5039d2ad9ab"
                },
                {
                  "fixed": "55712452b4f630978537bdb2a07dc958202336bb"
                },
                {
                  "fixed": "60747cc8c2fb855798c923b5537888f8d0969568"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "4.0.0"
                      },
                      {
                        "fixed": "4.0.22"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "3.4.17"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "55712452b4f630978537bdb2a07dc958202336bb"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "60747cc8c2fb855798c923b5537888f8d0969568"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "c5fb664d17ed9ae919394514ea69a5039d2ad9ab"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v3.4.17"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v4.0.21",
            "v4.0.20",
            "v4.0.19",
            "v4.0.18",
            "v4.0.17",
            "v4.0.16",
            "v3.4.16",
            "v4.0.15",
            "v3.4.15",
            "v3.4.14",
            "v4.0.14",
            "v3.4.11",
            "v3.4.10",
            "v4.0.13",
            "v3.4.9",
            "v4.0.12",
            "v4.0.11",
            "v3.4.8",
            "v4.0.10",
            "v3.4.7",
            "v3.4.6",
            "v4.0.9",
            "v4.0.8",
            "v4.0.7",
            "v4.0.6",
            "v3.4.5",
            "v3.4.4",
            "v4.0.5",
            "v4.0.4",
            "v3.4.3",
            "v4.0.3",
            "v3.4.2",
            "v3.4.1",
            "v4.0.2",
            "v4.0.1",
            "v3.4.0",
            "v4.0.0-beta.2",
            "v3.4.0-beta.1",
            "v4.0.0-beta.1",
            "v4.0.0-alpha.7",
            "v4.0.0-alpha.6",
            "v3.4.0-alpha.7",
            "v3.4.0-alpha.6",
            "v3.4.0-alpha.5",
            "v4.0.0-alpha.5",
            "v3.4.0-alpha.4",
            "v3.4.0-alpha.3",
            "v3.4.0-alpha.2",
            "v3.4.0-alpha.1",
            "v4.0.0-alpha.4",
            "v4.0.0-alpha.3",
            "v4.0.0-alpha.2",
            "v4.0.0-alpha.1",
            "v3.3.0-beta.2",
            "v3.3.0-beta.1",
            "v3.3.0-alpha.2",
            "v3.3.0-alpha.1",
            "v3.2.0-alpha.2",
            "v3.2.0-alpha.1",
            "v3.0.0",
            "v3.0.0-rc.2",
            "v3.0.0-rc.1",
            "v3.0.0-beta.2",
            "v2.7.0-alpha.2",
            "v2.7.0-alpha.1",
            "v2.6.0",
            "v2.6.0-beta.1",
            "v2.6.0-alpha.1",
            "v2.5.0-beta.1",
            "v2.4.0-beta.1",
            "v2.3.0",
            "v2.3.0-beta.1",
            "v2.2.1",
            "remove",
            "push",
            "v2.2.0",
            "v2.2.0-beta.2",
            "v2.2.0-beta.1",
            "v2.1.0",
            "v2.1.0-beta.2",
            "v2.1.0-beta.1",
            "v2.0.0",
            "v2.0.0-rc.6",
            "v2.0.0-rc.5",
            "v2.0.0-rc.4",
            "v2.0.0-rc.3",
            "v2.0.0-rc.2",
            "v2.0.0-rc.1",
            "v2.0.0-beta.3",
            "v2.0.0-beta.2",
            "v2.0.0-beta.1",
            "v2.0.0-alpha.2",
            "v2.0.0-alpha.1",
            "v1.0.0-beta.3",
            "v1.0.0-beta.2",
            "v1.0.0-beta"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-31481.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:38.204850939Z",
      "provider": "osv",
      "references": [
        "https://github.com/api-platform/core/releases/tag/v3.4.17",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31481.json",
        "https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-31481",
        "https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb",
        "https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-863"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31481.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-31481",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 505667,
  "published_at": "2025-04-03T19:20:22.916+00:00"
}