CVE-2025-31481
HIGHAPI Platform Core 3.4.0-3.4.16 and 4.0.0-alpha.1-4.0.21 - Incorrect Authorization via Relay Node Type
Title source: llmDescription
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.
References (4)
Core 4
Core References
Vendor Advisory x_refsource_confirm
https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m
Patch x_refsource_misc
https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb
Patch x_refsource_misc
https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568
Release Notes x_refsource_misc
https://github.com/api-platform/core/releases/tag/v3.4.17
Scores
CVSS v3
7.5
EPSS
0.0039
EPSS Percentile
30.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-863
Status
published
Products (4)
api-platform/core
4.0.0-alpha.1 - 4.0.22Packagist
api-platform/core
< 3.4.17
api-platform/core
>= 4.0.0, < 4.0.22
api-platform/graphql
4.0.0-alpha.1 - 4.0.22Packagist
Published
Apr 03, 2025
Tracked Since
Feb 18, 2026