CVE-2025-23204: API Platform Core GraphQL Security Bypass Vulnerability
Summary
CVE-2025-23204: API Platform Core does not call GraphQl securityAfterResolver. Affects api-platform/core versions >= 3.3.8, < 3.3.15. Fixed in 3.3.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
API Platform Core is a powerful framework for building APIs in PHP, designed to facilitate the creation of REST and GraphQL APIs. It provides features such as data serialization, validation, and security mechanisms to protect API endpoints. However, a recent vulnerability has been identified that affects the GraphQL security checks, potentially allowing unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability arises from a flaw in the GraphQL security mechanism where the security check that should be executed after GraphQL resolvers is improperly replaced by another check. This issue occurs due to a lack of a break clause in the code, leading to a fallback to a less secure security check. As a result, if there is only a security after resolver and no checks within the security, unauthorized users may gain access to restricted data. This vulnerability has been assigned a CVSS score of 4.4, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.3.15
This is the first release that contains the fix.
composer require api-platform/core:3.3.15Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional security checks within your GraphQL resolvers to ensure that unauthorized access is prevented until the package can be updated. This may involve manually checking user permissions before returning sensitive data.
Conclusion
The CVE-2025-23204 vulnerability in API Platform Core poses a risk of unauthorized access to sensitive data through improper security checks in GraphQL. It is crucial to update to the patched version 3.3.15 or later to mitigate this risk. For those unable to update immediately, implementing additional security checks is advised.
See every vulnerability recorded for api-platform/core →
FAQ
CVE-2025-23204 is a vulnerability in API Platform Core that allows for potential unauthorized access to data due to improper security checks in GraphQL.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability has a CVSS score of 4.4, indicating a moderate severity level.
If you cannot update the package right away, implement additional security checks in your GraphQL resolvers as a temporary workaround.
More information about API Platform Core can be found on its official documentation site, which provides comprehensive guides and resources.
References
Related vulnerabilities
Recent vulnerabilities recorded for api-platform/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
