CVE-2025-23204 json
GraphQl securityAfterResolver not called
published 2025-03-24 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-7991 , GHSA-7mxx-3cgm-xxv3
- cvss
- 4.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As this falls back to `security`, the impact is there only when there's only a security after resolver and none inside security. Version 3.3.15 contains a patch for the issue.
Patch / fix
- packagist api-platform/core 3.3.15
- api-platform core 3.3.15
- github.com/api-platform/core@dc4fc84 commit
- github.com/api-platform/core#6444 pull request
- github.com/api-platform/core#6444 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | api-platform/core | >=3.3.8, <3.3.15 |
3.3.15 |
Affected products
- api-platform core
Classification
References
-
github.com
/api-platform/core/pull/6444
web
-
github.com
/api-platform/core/pull/6444/files#diff-09e3c2cfe12a2ce65bd6c983c7ca6bfcf783f852b8d0554bb938e8ebf5e5fa65R56
web
-
github.com
/api-platform/core/commit/dc4fc84ba93e22b4f44a37e90a93c6d079c1c620
web
-
github.com
/api-platform/core/security/advisories/GHSA-7mxx-3cgm-xxv3
web
-
github.com
/soyuka/core/blob/7e2e8f9ff322ac5f6eb5f65baf432bffdca0fd51/src/Symfony/Security/State/AccessCheckerProvider.ph
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-23204
advisory
-
github.com
/api-platform/core
package
Sources
- CVE List CVE-2025-23204
- GitHub Advisory GHSA-7mxx-3cgm-xxv3
- NVD CVE-2025-23204
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.