{"id":"CVE-2025-31481","aliases":["GHSA-cg3c-245w-728m"],"url":"https://o3.security/vulnerability/CVE-2025-31481","summary":"GraphQL query operations security can be bypassed","details":"### Summary\n\nUsing the Relay special `node` type you can bypass the configured security on an operation.\n\n### Details\n\nHere is an example of how to apply security configurations for the GraphQL operations:\n\n```php\n#[ApiResource(\n    security: \"is_granted('ROLE_USER')\",\n    operations: [ /* ... */ ],\n    graphQlOperations: [\n        new Query(security: \"is_granted('ROLE_USER')\"),\n        //...\n    ],\n)]\nclass Book { /* ... */ }\n```\n\nThis indeed checks `is_granted('ROLE_USER')` as expected for a GraphQL query like the following:\n\n```php\n‌query {\n    book(id: \"/books/1\") {\n        title\n    }\n}\n```\n\nBut the security check can be bypassed by using the `node` field (that is available by default) on the root query type like that:\n\n```php\n‌query {\n    node(id: \"/books/1\") {\n        ... on Book {\n            title\n        }\n    }\n}\n```\n\nThis does not execute any security checks and can therefore be used to access any entity without restrictions by everyone that has access to the API.\n\n### Impact\n\nEveryone using GraphQl with the `security` attribute. Not sure whereas this works with custom resolvers nor if this also applies on mutation.\n\nPatched at https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568","published":"2025-04-03T19:20:22.916Z","modified":"2026-10-28T02:30:38.204850939Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00458,"percentile":0.38854,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"api-platform/graphql","fixedVersion":"4.0.22"},{"ecosystem":"Packagist","name":"api-platform/core","fixedVersion":"4.0.22"},{"ecosystem":"Packagist","name":"api-platform/graphql","fixedVersion":"3.4.17"},{"ecosystem":"Packagist","name":"api-platform/core","fixedVersion":"3.4.17"},{"ecosystem":"Packagist","name":"api-platform/graphql","fixedVersion":"4.1.5"},{"ecosystem":"Packagist","name":"api-platform/core","fixedVersion":"4.1.5"}],"fix":{"url":"https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb","label":"api-platform/core@5571245"},"references":[{"type":"WEB","url":"https://github.com/api-platform/core/releases/tag/v3.4.17"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31481.json"},{"type":"ADVISORY","url":"https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31481"},{"type":"FIX","url":"https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb"},{"type":"FIX","url":"https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31481.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31481.yaml"},{"type":"PACKAGE","url":"https://github.com/api-platform/core"},{"type":"WEB","url":"https://github.com/api-platform/core/releases/tag/v4.1.5"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:38.204850939Z"}}