PT-2025-14792 · Unknown · Api Platform Core

Published 2025-04-03 · Updated 2026-01-13 · CVE-2025-31481

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions API Platform Core versions prior to 4.0.22

Description The issue allows bypassing configured security on an operation using the Relay special node type in hypermedia-driven REST and GraphQL APIs.

Recommendations For versions prior to 4.0.22, update to version 4.0.22 to resolve the issue.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-31481

GHSA-CG3C-245W-728M

Affected Products

Api Platform Core

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31481.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31481.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31481.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-31481 · Security Note
• https://osv.dev/vulnerability/CVE-2025-31481 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cg3c-245w-728m · Vendor Advisory
• https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568 · Note
• https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m · Note
• https://github.com/api-platform/core/releases/tag/v3.4.17 · Note
• https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb · Note
• https://github.com/api-platform/core/releases/tag/v4.1.5 · Note
• https://github.com/api-platform/core · Note
• https://twitter.com/CVETracker/status/1908248391047328154 · Twitter Post
• https://t.me/cvedetector/22019 · Telegram Post
• https://twitter.com/_cvereports/status/1908572388708802895 · Twitter Post