What’s Vulnerable › Vulnerabilities

CVE-2025-31481: GraphQL query operations security can be bypassed

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-03 · updated 2026-06-17
• Weakness: CWE-863

Description

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.

Affected products

• api-platform core: from 4.0.0, < 4.0.22; before 3.4.17

References

• https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb
• https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568
• https://github.com/api-platform/core/releases/tag/v3.4.17
• https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m

Get alerted when CVE-2025-31481 or the next vulnerability affects your stack