CVE-2025-31485: api-platform/graphql and api-platform/core - GraphQL Grant Caching Vulnerability
Summary
CVE-2025-31485: GraphQL grant on a property might be cached with different objects. Affects api-platform/graphql across 3 version ranges.
< 3.4.17
>= 4.0.0-alpha.1, < 4.0.22
>= 4.1.0-alpha.1, < 4.1.5
Fixed in 3.4.17, 4.0.22 or 4.1.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The api-platform/graphql and api-platform/core packages are integral parts of the API Platform framework, which is designed to facilitate the development of web APIs. These packages provide tools for building GraphQL APIs, enabling developers to define data structures and queries efficiently. However, a vulnerability exists in the way security grants are cached for properties in the GraphQL ItemNormalizer, potentially leading to unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability arises from the caching mechanism in the GraphQL ItemNormalizer, where security grants on properties are evaluated only once and cached. This means that if a different object is passed, the cached grant may still apply, allowing access to properties that should be restricted. This flaw can lead to unauthorized data exposure, posing a significant security risk to applications using these packages.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.4.173.4.17composer require api-platform/graphql:3.4.17 -
>= 4.0.0-alpha.1, < 4.0.224.0.22composer require api-platform/graphql:4.0.22 -
>= 4.1.0-alpha.1, < 4.1.54.1.5composer require api-platform/graphql:4.1.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can override the ItemNormalizer to customize the caching behavior. This involves creating a new normalizer class that implements your desired security checks without relying on the default caching mechanism.
Conclusion
In summary, CVE-2025-31485 presents a significant security risk for applications using the api-platform/graphql and api-platform/core packages due to improper caching of security grants. It is crucial to update to the patched version or implement a workaround to mitigate this vulnerability.
See every vulnerability recorded for api-platform/graphql →
FAQ
CVE-2025-31485 is a vulnerability affecting the api-platform/graphql and api-platform/core packages, where security grants on properties may be cached incorrectly, leading to unauthorized access.
If your application uses these packages, it may inadvertently expose sensitive properties to users who should not have access, potentially compromising data security.
If updating is not immediately possible, consider implementing the suggested workaround by overriding the ItemNormalizer to prevent caching issues.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for api-platform/graphql.
