CVE-2025-23204 json
GraphQl securityAfterResolver not called
published last yr. modified 4mo ago also EUVD-2025-7991 , GHSA-7mxx-3cgm-xxv3
- cvss
- 4.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As this falls back to `security`, the impact is there only when there's only a security after resolver and none inside security. Version 3.3.15 contains a patch for the issue.
Patch / fix
- packagist api-platform/core 3.3.15
- api-platform core 3.3.15
- github.com/api-platform/core@dc4fc84 commit
- github.com/api-platform/core#6444 pull request
- github.com/api-platform/core#6444 pull request
Is CVE-2025-23204 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | api-platform/core | >=3.3.8, <3.3.15 |
3.3.15 |
Affected products
- api-platform core
Classification
References
-
github.com
/api-platform/core/pull/6444
web
-
github.com
/api-platform/core/pull/6444/files#diff-09e3c2cfe12a2ce65bd6c983c7ca6bfcf783f852b8d0554bb938e8ebf5e5fa65R56
web
-
github.com
/api-platform/core/commit/dc4fc84ba93e22b4f44a37e90a93c6d079c1c620
web
-
github.com
/api-platform/core/security/advisories/GHSA-7mxx-3cgm-xxv3
web
-
github.com
/soyuka/core/blob/7e2e8f9ff322ac5f6eb5f65baf432bffdca0fd51/src/Symfony/Security/State/AccessCheckerProvider.ph
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-23204
advisory
-
github.com
/api-platform/core
package
Sources
- CVE List CVE-2025-23204
- GitHub Advisory GHSA-7mxx-3cgm-xxv3
- NVD CVE-2025-23204
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.