api-platform/graphql vulnerabilities

Latest api-platform/graphql CVEs

Newest publication first

1. CVE-2025-31485 GraphQL grant on a property might be cached with different objects

   Published 2025-04-03

   High·CVSS 7.5 EPSS 0.63%

   API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is meant to prevent the ca...

2. CVE-2025-31481 GraphQL query operations security can be bypassed

   Published 2025-04-03

   High·CVSS 7.5 EPSS 0.48%

   API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.