api-platform/core

The server component of API Platform: hypermedia and GraphQL APIs in minutes

View on Packagist

View on Github

Activity

Latest release: 1w ago
Total releases: 399
Cadence: ~daily
Last 12 months: 78

Reach

Stars: 2.6k

Details

License: MIT
First release: Jun 08, 2015

Releases

Version	Released
`v5.0.5` patch	Oct 23, 2026
`v4.4.6` patch	Oct 23, 2026
`v5.0.4` patch	Oct 16, 2026
`v4.4.5` patch	Oct 16, 2026
`v5.0.3` patch	Oct 09, 2026
`v4.4.4` patch	Oct 09, 2026
`v5.0.2` patch	Oct 02, 2026
`v4.4.3` patch	Oct 02, 2026
`v4.3.21` patch	Sep 29, 2026
`v5.0.1` patch	Sep 25, 2026
`v4.4.2` patch	Sep 25, 2026
`v4.3.20` patch	Sep 25, 2026
`v4.4.1` patch	Sep 22, 2026
`v5.0.0` major	Sep 16, 2026
`v4.4.0` minor	Sep 16, 2026
`v5.0.0-beta.2` pre	Sep 15, 2026
`v4.4.0-beta.3` pre	Sep 15, 2026
`v4.4.0-beta.2` pre	Sep 15, 2026
`v5.0.0-beta.1` pre	Sep 12, 2026
`v4.4.0-beta.1` pre	Sep 12, 2026
`v4.3.19` patch	Sep 12, 2026
`v5.0.0-alpha.3` pre	Sep 04, 2026
`v4.4.0-alpha.4` pre	Sep 04, 2026
`v4.3.18` patch	Sep 04, 2026
`v5.0.0-alpha.2` pre	Jul 12, 2026
`v4.4.0-alpha.3` pre	Jul 12, 2026
`v4.3.17` patch	Jul 12, 2026
`v4.3.16` patch	Jul 03, 2026
`v5.0.0-alpha.1` pre	Jun 29, 2026
`v4.3.15` patch	Jun 26, 2026
`v4.4.0-alpha.2` pre	Jun 26, 2026
`v4.4.0-alpha.1` pre	Jun 25, 2026
`v4.3.14` patch	Jun 19, 2026
`v4.3.13` patch	Jun 13, 2026
`v4.3.12` patch	Jun 13, 2026
`v4.2.26` patch	Jun 13, 2026
`v4.1.30` patch	Jun 13, 2026
`v4.3.11` patch 1 CVE	Jun 12, 2026
`v4.3.10` patch 1 CVE	Jun 05, 2026
`v4.3.9` patch 1 CVE	Jun 04, 2026
`v4.3.8` patch 1 CVE	Jun 04, 2026
`v4.2.25` patch 1 CVE	Jun 04, 2026
`v4.1.29` patch 1 CVE	Jun 04, 2026
`v4.3.7` patch 2 CVEs	May 29, 2026
`v4.3.6` patch 2 CVEs	May 22, 2026
`v4.3.5` patch 2 CVEs	May 11, 2026
`v4.3.4` patch 2 CVEs	Apr 30, 2026
`v4.3.3` patch 2 CVEs	Mar 29, 2026
`v4.2.24` patch 2 CVEs	Mar 29, 2026
`v4.3.2` patch 2 CVEs	Mar 27, 2026

1–50 of 399

Repository

api-platform/core

Forks: 986
Open issues: 78
Language: PHP
: 5.2/ 10

api
rest
graphql
json-ld
swagger
hydra-api

Dependencies (16)

Depends on

v5.0.5

Supply-chain exposure

Known CVEs (8)

CVE-2026-54164 GHSA-9rjg-x2p2-h68h Aug 07, 2026

API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)

6.5 / 10
Medium
Network Low Low None Unchanged None High None

Summary

The API Platform serializer's AbstractItemNormalizer does not validate the resource type returned when resolving relation IRIs, allowing type confusion where a resource of an unintended type can be silently assigned to a relation property.

Impact

An attacker who can submit write requests (POST/PUT/PATCH) to an API Platform endpoint with writable relations can supply a relation IRI pointing to a resource of a different type than the relation's declared class. Because getResourceFromIri() does not pass an $operation to IriConverter::getResourceFromIri(), the is_a type guard at IriConverter.php:86 is skipped. For untyped relation properties (legacy @var-only style), the wrong-typed object is silently assigned, corrupting invariants and potentially feeding downstream logic that assumes the declared type (CWE-843). For typed properties (modern PHP 8.x), the substitution is blocked by Symfony's PropertyAccessor with an InvalidTypeException.

Affected versions

api-platform/core < 4.1.30

api-platform/core >= 4.2.0, < 4.2.26

api-platform/core >= 4.3.0, < 4.3.12

Older major series (2.x, 3.x) ship the same vulnerable code path and are end-of-life; no fix is planned.

Patched versions

4.1.30

4.2.26

4.3.12

Fix

An is_a guard is added inside AbstractItemNormalizer::getResourceFromIri() (and the equivalent inline call sites on 4.1) so that a mismatched IRI throws InvalidArgumentException, mirroring the operation-aware check the IriConverter already performs when an operation is supplied. This forces a 400 Bad Request response for cross-type IRIs instead of a silent assignment.

Workarounds

Declare a PHP type on every writable relation property (e.g. public ?Foo $relation = null; instead of @var Foo $relation). Symfony's PropertyAccessor will then reject a mismatched object with InvalidTypeException. This does not cover collections of mixed-type interfaces; upgrading to a patched version is the only complete fix.

Proof of concept

A functional test posts a Bar IRI to a Foo-declared relation on an untyped property. Without the fix the server responds with HTTP 201 and the Bar IRI appears in the response payload. With the fix the server responds with HTTP 400 (Invalid IRI "/bars/1").

Full PoC: tests/Functional/Security/TypeConfusionRelationIriTest.php in the patched branches.

References

src/Serializer/AbstractItemNormalizer.php — vulnerable relation IRI load

src/Symfony/Routing/IriConverter.php — conditional is_a guard (operation-aware path)

Credit

Reported by @alexandre-daubois.

Affected versions

4.1.14v1.0.0v1.0.0-betav1.0.0-beta.2v1.0.0-beta.3v1.0.1v1.1.0v1.1.0-beta.1v1.1.0-beta.2v1.1.1v2.0.0v2.0.0-alpha.1

+ 344 more Show less

v2.0.0-alpha.2v2.0.0-beta.1v2.0.0-beta.2v2.0.0-beta.3v2.0.0-rc.1v2.0.0-rc.2v2.0.0-rc.3v2.0.0-rc.4v2.0.0-rc.5v2.0.0-rc.6v2.0.1v2.0.10v2.0.11v2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.0.7v2.0.8v2.0.9v2.1.0v2.1.0-beta.1v2.1.0-beta.2v2.1.1v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.2.0v2.2.0-beta.1v2.2.0-beta.2v2.2.1v2.2.10v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.0-beta.1v2.3.1v2.3.2v2.3.3v2.3.4v2.3.5v2.3.6v2.4.0v2.4.0-beta.1v2.4.0-beta.2v2.4.1v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.5.0v2.5.0-beta.1v2.5.0-beta.2v2.5.1v2.5.10v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-alpha.1v2.6.0-beta.1v2.6.1v2.6.2v2.6.3v2.6.3-alpha.1v2.6.3.alphav2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.7.0v2.7.0-alpha.1v2.7.0-alpha.2v2.7.0-alpha.3v2.7.0-alpha.4v2.7.0-alpha.5v2.7.0-alpha.6v2.7.0-alpha.7v2.7.0-beta.1v2.7.0-beta.2v2.7.0-beta.3v2.7.0-beta.4v2.7.0-beta.5v2.7.0-rc.1v2.7.0-rc.2v2.7.1v2.7.10v2.7.11v2.7.12v2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.2v2.7.3v2.7.4v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9v3.0.0v3.0.0-beta.1v3.0.0-beta.2v3.0.0-rc.1v3.0.0-rc.2v3.0.1v3.0.10v3.0.11v3.0.12v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.1v3.1.10v3.1.11v3.1.12v3.1.13v3.1.14v3.1.15v3.1.16v3.1.17v3.1.18v3.1.19v3.1.2v3.1.20v3.1.21v3.1.22v3.1.23v3.1.24v3.1.25v3.1.26v3.1.27v3.1.28v3.1.29v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-alpha.1v3.2.0-alpha.2v3.2.0-beta.1v3.2.0-beta.2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.15v3.2.16v3.2.17v3.2.18v3.2.19v3.2.2v3.2.20v3.2.21v3.2.22v3.2.23v3.2.24v3.2.25v3.2.26v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-alpha.1v3.3.0-alpha.2v3.3.0-beta.1v3.3.0-beta.2v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14v3.3.15v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.0-alpha.1v3.4.0-alpha.2v3.4.0-alpha.3v3.4.0-alpha.4v3.4.0-alpha.5v3.4.0-alpha.6v3.4.0-alpha.7v3.4.0-beta.1v3.4.1v3.4.10v3.4.11v3.4.14v3.4.15v3.4.16v3.4.17v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v4.0.0v4.0.0-alpha.1v4.0.0-alpha.2v4.0.0-alpha.3v4.0.0-alpha.4v4.0.0-alpha.5v4.0.0-alpha.6v4.0.0-alpha.7v4.0.0-beta.1v4.0.0-beta.2v4.0.1v4.0.10v4.0.11v4.0.12v4.0.13v4.0.14v4.0.15v4.0.16v4.0.17v4.0.18v4.0.19v4.0.2v4.0.20v4.0.21v4.0.22v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-alpha.1v4.1.0-alpha.2v4.1.0-beta.1v4.1.0-beta.2v4.1.1v4.1.10v4.1.11v4.1.12v4.1.15v4.1.16v4.1.17v4.1.18v4.1.19v4.1.2v4.1.20v4.1.21v4.1.22v4.1.23v4.1.24v4.1.25v4.1.26v4.1.27v4.1.28v4.1.29v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.1v4.2.10v4.2.11v4.2.12v4.2.13v4.2.14v4.2.15v4.2.16v4.2.17v4.2.18v4.2.19v4.2.2v4.2.20v4.2.21v4.2.22v4.2.23v4.2.24v4.2.25v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9v4.3.0v4.3.1v4.3.10v4.3.11v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7v4.3.8v4.3.9

Fixed in

4.1.304.2.264.3.12

References

https://github.com/api-platform/core/security/advisories/GHSA-9rjg-x2p2-h68h
https://nvd.nist.gov/vuln/detail/CVE-2026-54164
https://github.com/api-platform/core/commit/6bcbeb2dbee53db5bb9b4b8e343bffdf7732de1e
https://github.com/api-platform/core
https://github.com/api-platform/core/releases/tag/v4.1.30
https://github.com/api-platform/core/releases/tag/v4.2.26

Updated Aug 07, 2026 · Source: OSV.dev
CVE-2026-49858 GHSA-pjhx-3c3w-9v23 Jul 10, 2026

API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

5.9 / 10
Medium
Network High None None Unchanged High None None

Impact

#[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context['cache_key'], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them.

This is the same vulnerability class as GHSA-428q-q3vv-3fq3 / CVE-2025-31485, which fixed only the GraphQL ItemNormalizer. The JSON:API and HAL paths were not addressed at the time.

Exploitation conditions

Exploitation requires all of the following to coincide:

The application exposes a resource via the JSON:API and/or HAL formats.

At least one property of that resource uses #[ApiProperty(security: ...)] with a predicate whose result depends on the current user (or on per-request state).

A request from a user for whom the predicate evaluates to true populates componentsCache before a request from a user for whom the predicate evaluates to false, within the lifetime of the same PHP process.

The deployment uses a long-running PHP runtime that keeps the normalizer instance alive across requests (FrankenPHP worker mode, RoadRunner, Swoole, ReactPHP, etc.). With classic php-fpm workers the cache only survives the duration of a single request, which makes the issue much harder to observe in practice.

Patches

4.1.29

4.2.25

4.3.8

All three branches receive patched releases of api-platform/core, api-platform/json-api, and api-platform/hal.

Workarounds

Override the JSON:API and HAL ItemNormalizer services to gate $context['cache_key'] with a resource-class security check, or avoid #[ApiProperty(security: ...)] on resources served as JSON:API or HAL until the patch is applied. Pinning the deployment to classic php-fpm workers also limits exposure since the cache does not survive across requests.

Credits

Tillmann Baumgart (@tillmon) — originally identified the broader cache-key gap and proposed moving isCacheKeySafe to AbstractItemNormalizer.

Antoine Bluchet (@soyuka) — extended the gate to JSON:API and HAL normalizers.

Affected versions

4.1.14v2.6.0v2.6.1v2.6.2v2.6.3v2.6.3-alpha.1v2.6.3.alphav2.6.4v2.6.5v2.6.6v2.6.7v2.6.8

+ 251 more Show less

v2.7.0v2.7.0-alpha.1v2.7.0-alpha.2v2.7.0-alpha.3v2.7.0-alpha.4v2.7.0-alpha.5v2.7.0-alpha.6v2.7.0-alpha.7v2.7.0-beta.1v2.7.0-beta.2v2.7.0-beta.3v2.7.0-beta.4v2.7.0-beta.5v2.7.0-rc.1v2.7.0-rc.2v2.7.1v2.7.10v2.7.11v2.7.12v2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.2v2.7.3v2.7.4v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9v3.0.0v3.0.0-beta.1v3.0.0-beta.2v3.0.0-rc.1v3.0.0-rc.2v3.0.1v3.0.10v3.0.11v3.0.12v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.1v3.1.10v3.1.11v3.1.12v3.1.13v3.1.14v3.1.15v3.1.16v3.1.17v3.1.18v3.1.19v3.1.2v3.1.20v3.1.21v3.1.22v3.1.23v3.1.24v3.1.25v3.1.26v3.1.27v3.1.28v3.1.29v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-alpha.1v3.2.0-alpha.2v3.2.0-beta.1v3.2.0-beta.2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.15v3.2.16v3.2.17v3.2.18v3.2.19v3.2.2v3.2.20v3.2.21v3.2.22v3.2.23v3.2.24v3.2.25v3.2.26v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-alpha.1v3.3.0-alpha.2v3.3.0-beta.1v3.3.0-beta.2v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14v3.3.15v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.0-alpha.1v3.4.0-alpha.2v3.4.0-alpha.3v3.4.0-alpha.4v3.4.0-alpha.5v3.4.0-alpha.6v3.4.0-alpha.7v3.4.0-beta.1v3.4.1v3.4.10v3.4.11v3.4.14v3.4.15v3.4.16v3.4.17v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v4.0.0v4.0.0-alpha.1v4.0.0-alpha.2v4.0.0-alpha.3v4.0.0-alpha.4v4.0.0-alpha.5v4.0.0-alpha.6v4.0.0-alpha.7v4.0.0-beta.1v4.0.0-beta.2v4.0.1v4.0.10v4.0.11v4.0.12v4.0.13v4.0.14v4.0.15v4.0.16v4.0.17v4.0.18v4.0.19v4.0.2v4.0.20v4.0.21v4.0.22v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-alpha.1v4.1.0-alpha.2v4.1.0-beta.1v4.1.0-beta.2v4.1.1v4.1.10v4.1.11v4.1.12v4.1.15v4.1.16v4.1.17v4.1.18v4.1.19v4.1.2v4.1.20v4.1.21v4.1.22v4.1.23v4.1.24v4.1.25v4.1.26v4.1.27v4.1.28v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.1v4.2.10v4.2.11v4.2.12v4.2.13v4.2.14v4.2.15v4.2.16v4.2.17v4.2.18v4.2.19v4.2.2v4.2.20v4.2.21v4.2.22v4.2.23v4.2.24v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9v4.3.0v4.3.1v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7

Fixed in

4.1.294.2.254.3.8

References

https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23
https://nvd.nist.gov/vuln/detail/CVE-2026-49858
https://github.com/api-platform/core

Updated Jul 10, 2026 · Source: OSV.dev
CVE-2025-31485 GHSA-428q-q3vv-3fq3 Apr 04, 2025

GraphQL grant on a property might be cached with different objects

7.5 / 10
High
Network Low None None Unchanged High None None

Original message:

I found an issue with security grants on on properties in the GraphQL ItemNormalizer:

If you use something like #[ApiProperty(security: 'is_granted("PROPERTY_READ", [object, property])')] on a member of an entity, the grant gets cached and is only evaluated once, even if the object in question is a different one.

There is the ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method that seems to be intended to prevent this: https://github.com/api-platform/core/blob/88f5ac50d20d6510686a7552310cc567fcca45bf/src/GraphQl/Serializer/ItemNormalizer.php#L160-L164
and in its usage on line 90 it does indeed not create a cache key, but the parent::normalize() that is called afterwards still creates the cache key and causes the issue.

Impact

It grants access to properties that it should not.

Workarounds

Override the ItemNormalizer.

Patched at: https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8

Affected versions

v4.0.0v4.0.0-alpha.1v4.0.0-alpha.2v4.0.0-alpha.3v4.0.0-alpha.4v4.0.0-alpha.5v4.0.0-alpha.6v4.0.0-alpha.7v4.0.0-beta.1v4.0.0-beta.2v4.0.1v4.0.10

+ 280 more Show less

v4.0.11v4.0.12v4.0.13v4.0.14v4.0.15v4.0.16v4.0.17v4.0.18v4.0.19v4.0.2v4.0.20v4.0.21v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v1.0.0v1.0.0-betav1.0.0-beta.2v1.0.0-beta.3v1.0.1v1.1.0v1.1.0-beta.1v1.1.0-beta.2v1.1.1v2.0.0v2.0.0-alpha.1v2.0.0-alpha.2v2.0.0-beta.1v2.0.0-beta.2v2.0.0-beta.3v2.0.0-rc.1v2.0.0-rc.2v2.0.0-rc.3v2.0.0-rc.4v2.0.0-rc.5v2.0.0-rc.6v2.0.1v2.0.10v2.0.11v2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.0.7v2.0.8v2.0.9v2.1.0v2.1.0-beta.1v2.1.0-beta.2v2.1.1v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.2.0v2.2.0-beta.1v2.2.0-beta.2v2.2.1v2.2.10v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.0-beta.1v2.3.1v2.3.2v2.3.3v2.3.4v2.3.5v2.3.6v2.4.0v2.4.0-beta.1v2.4.0-beta.2v2.4.1v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.5.0v2.5.0-beta.1v2.5.0-beta.2v2.5.1v2.5.10v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-alpha.1v2.6.0-beta.1v2.6.1v2.6.2v2.6.3v2.6.3-alpha.1v2.6.3.alphav2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.7.0v2.7.0-alpha.1v2.7.0-alpha.2v2.7.0-alpha.3v2.7.0-alpha.4v2.7.0-alpha.5v2.7.0-alpha.6v2.7.0-alpha.7v2.7.0-beta.1v2.7.0-beta.2v2.7.0-beta.3v2.7.0-beta.4v2.7.0-beta.5v2.7.0-rc.1v2.7.0-rc.2v2.7.1v2.7.10v2.7.11v2.7.12v2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.2v2.7.3v2.7.4v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9v3.0.0v3.0.0-beta.1v3.0.0-beta.2v3.0.0-rc.1v3.0.0-rc.2v3.0.1v3.0.10v3.0.11v3.0.12v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.1v3.1.10v3.1.11v3.1.12v3.1.13v3.1.14v3.1.15v3.1.16v3.1.17v3.1.18v3.1.19v3.1.2v3.1.20v3.1.21v3.1.22v3.1.23v3.1.24v3.1.25v3.1.26v3.1.27v3.1.28v3.1.29v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-alpha.1v3.2.0-alpha.2v3.2.0-beta.1v3.2.0-beta.2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.15v3.2.16v3.2.17v3.2.18v3.2.19v3.2.2v3.2.20v3.2.21v3.2.22v3.2.23v3.2.24v3.2.25v3.2.26v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-alpha.1v3.3.0-alpha.2v3.3.0-beta.1v3.3.0-beta.2v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14v3.3.15v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.0-alpha.1v3.4.0-alpha.2v3.4.0-alpha.3v3.4.0-alpha.4v3.4.0-alpha.5v3.4.0-alpha.6v3.4.0-alpha.7v3.4.0-beta.1v3.4.1v3.4.10v3.4.11v3.4.14v3.4.15v3.4.16v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v4.1.0v4.1.0-alpha.1v4.1.0-alpha.2v4.1.0-beta.1v4.1.0-beta.2v4.1.1v4.1.2v4.1.3v4.1.4

Fixed in

3.4.174.0.224.1.5

References

https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3
https://nvd.nist.gov/vuln/detail/CVE-2025-31485
https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8
https://github.com/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a
https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31485.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31485.yaml

Updated Aug 29, 2025 · Source: OSV.dev
CVE-2025-31481 GHSA-cg3c-245w-728m Apr 04, 2025

GraphQL query operations security can be bypassed

7.5 / 10
High
Network Low None None Unchanged High None None

Summary

Using the Relay special node type you can bypass the configured security on an operation.

Details

Here is an example of how to apply security configurations for the GraphQL operations:

#[ApiResource( security: "is_granted('ROLE_USER')", operations: [ /* ... */ ], graphQlOperations: [ new Query(security: "is_granted('ROLE_USER')"), //... ], )] class Book { /* ... */ }

This indeed checks is_granted('ROLE_USER') as expected for a GraphQL query like the following:

‌query { book(id: "/books/1") { title } }

But the security check can be bypassed by using the node field (that is available by default) on the root query type like that:

‌query { node(id: "/books/1") { ... on Book { title } } }

This does not execute any security checks and can therefore be used to access any entity without restrictions by everyone that has access to the API.

Impact

Everyone using GraphQl with the security attribute. Not sure whereas this works with custom resolvers nor if this also applies on mutation.

Patched at https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568

Affected versions

v4.0.0v4.0.0-alpha.1v4.0.0-alpha.2v4.0.0-alpha.3v4.0.0-alpha.4v4.0.0-alpha.5v4.0.0-alpha.6v4.0.0-alpha.7v4.0.0-beta.1v4.0.0-beta.2v4.0.1v4.0.10

+ 280 more Show less

v4.0.11v4.0.12v4.0.13v4.0.14v4.0.15v4.0.16v4.0.17v4.0.18v4.0.19v4.0.2v4.0.20v4.0.21v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v1.0.0v1.0.0-betav1.0.0-beta.2v1.0.0-beta.3v1.0.1v1.1.0v1.1.0-beta.1v1.1.0-beta.2v1.1.1v2.0.0v2.0.0-alpha.1v2.0.0-alpha.2v2.0.0-beta.1v2.0.0-beta.2v2.0.0-beta.3v2.0.0-rc.1v2.0.0-rc.2v2.0.0-rc.3v2.0.0-rc.4v2.0.0-rc.5v2.0.0-rc.6v2.0.1v2.0.10v2.0.11v2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.0.7v2.0.8v2.0.9v2.1.0v2.1.0-beta.1v2.1.0-beta.2v2.1.1v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.2.0v2.2.0-beta.1v2.2.0-beta.2v2.2.1v2.2.10v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.0-beta.1v2.3.1v2.3.2v2.3.3v2.3.4v2.3.5v2.3.6v2.4.0v2.4.0-beta.1v2.4.0-beta.2v2.4.1v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.5.0v2.5.0-beta.1v2.5.0-beta.2v2.5.1v2.5.10v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-alpha.1v2.6.0-beta.1v2.6.1v2.6.2v2.6.3v2.6.3-alpha.1v2.6.3.alphav2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.7.0v2.7.0-alpha.1v2.7.0-alpha.2v2.7.0-alpha.3v2.7.0-alpha.4v2.7.0-alpha.5v2.7.0-alpha.6v2.7.0-alpha.7v2.7.0-beta.1v2.7.0-beta.2v2.7.0-beta.3v2.7.0-beta.4v2.7.0-beta.5v2.7.0-rc.1v2.7.0-rc.2v2.7.1v2.7.10v2.7.11v2.7.12v2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.2v2.7.3v2.7.4v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9v3.0.0v3.0.0-beta.1v3.0.0-beta.2v3.0.0-rc.1v3.0.0-rc.2v3.0.1v3.0.10v3.0.11v3.0.12v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.1v3.1.10v3.1.11v3.1.12v3.1.13v3.1.14v3.1.15v3.1.16v3.1.17v3.1.18v3.1.19v3.1.2v3.1.20v3.1.21v3.1.22v3.1.23v3.1.24v3.1.25v3.1.26v3.1.27v3.1.28v3.1.29v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-alpha.1v3.2.0-alpha.2v3.2.0-beta.1v3.2.0-beta.2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.15v3.2.16v3.2.17v3.2.18v3.2.19v3.2.2v3.2.20v3.2.21v3.2.22v3.2.23v3.2.24v3.2.25v3.2.26v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-alpha.1v3.3.0-alpha.2v3.3.0-beta.1v3.3.0-beta.2v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14v3.3.15v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.0-alpha.1v3.4.0-alpha.2v3.4.0-alpha.3v3.4.0-alpha.4v3.4.0-alpha.5v3.4.0-alpha.6v3.4.0-alpha.7v3.4.0-beta.1v3.4.1v3.4.10v3.4.11v3.4.14v3.4.15v3.4.16v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v4.1.0v4.1.0-alpha.1v4.1.0-alpha.2v4.1.0-beta.1v4.1.0-beta.2v4.1.1v4.1.2v4.1.3v4.1.4

Fixed in

3.4.174.0.224.1.5

References

https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m
https://nvd.nist.gov/vuln/detail/CVE-2025-31481
https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb
https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568
https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31481.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31481.yaml

Updated Aug 29, 2025 · Source: OSV.dev
CVE-2023-47639 GHSA-rfw5-cqjj-7v9r Apr 03, 2025

API Platform Core can leak exceptions message that may contain sensitive information

5.3 / 10
Medium
Network Low None None Unchanged Low None None

Summary

Exception messages, that are not HTTP exceptions, are visible in the JSON error response.

Details

While we wanted to make our errors compatible with the JSON Problem specification, we ended up handling more exceptions then we did previously (introduced at https://github.com/api-platform/core/pull/5823). Instead of leaving that to Symfony, we ended up serializing errors with our normalizers which lead to not hiding the exception details. Note that the trace is hidden in production but the message is not, and the message can contain sensitive information.

PoC

At https://github.com/ili101/api-platform/tree/test3.2 it triggers an authentication exception as LDAP is not reachable. You can find the message available as a JSON response when trying to reach an endpoint.

Impact

Version 3.2 until 3.2.4 is impacted.

Affected versions

v3.2.0v3.2.1v3.2.2v3.2.3v3.2.4

Fixed in

3.2.5

References

https://github.com/api-platform/core/security/advisories/GHSA-rfw5-cqjj-7v9r
https://nvd.nist.gov/vuln/detail/CVE-2023-47639
https://github.com/api-platform/core/pull/5823
https://github.com/api-platform/core/commit/ba8a7e6538bccebf14c228e43a9339214c4d9201
https://github.com/api-platform/core

Updated Apr 04, 2025 · Source: OSV.dev
CVE-2025-23204 GHSA-7mxx-3cgm-xxv3 Mar 24, 2025

API Platform Core does not call GraphQl securityAfterResolver

4.4 / 10
Medium
Network High High None Changed Low Low None

Summary

A security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in this clause: https://github.com/api-platform/core/pull/6444/files#diff-09e3c2cfe12a2ce65bd6c983c7ca6bfcf783f852b8d0554bb938e8ebf5e5fa65R56

https://github.com/soyuka/core/blob/7e2e8f9ff322ac5f6eb5f65baf432bffdca0fd51/src/Symfony/Security/State/AccessCheckerProvider.php#L49-L57

PoC

Create a graphql endpoint with a security after resolver.

Impact

As this fallsback to security, the impact is there only when there's only a security after resolver and none inside security. The test at https://github.com/api-platform/core/pull/6444 is probably broken.

Affected versions

v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14v3.3.8v3.3.9

Fixed in

3.3.15

References

https://github.com/api-platform/core/security/advisories/GHSA-7mxx-3cgm-xxv3
https://nvd.nist.gov/vuln/detail/CVE-2025-23204
https://github.com/api-platform/core/pull/6444
https://github.com/api-platform/core/pull/6444/files#diff-09e3c2cfe12a2ce65bd6c983c7ca6bfcf783f852b8d0554bb938e8ebf5e5fa65R56
https://github.com/api-platform/core/commit/dc4fc84ba93e22b4f44a37e90a93c6d079c1c620
https://github.com/api-platform/core

Updated Mar 24, 2025 · Source: OSV.dev
CVE-2023-25575 GHSA-vr2x-7687-h6qv Feb 28, 2023

api-platform/core's secured properties may be accessible within collections

7.7 / 10
High
Network Low Low None Changed High None None

Impact

Resource properties secured with the security option of the ApiPlatform\Metadata\ApiProperty attribute can be disclosed to unauthorized users. The problem affects most serialization formats, including raw JSON, which is enabled by default when installing API Platform. Custom serialization formats may also be impacted. Only collection endpoints are affected by the issue, item endpoints are not. The JSON-LD format is not affected by the issue.

The result of the security rule is only executed for the first item of the collection. The result of the rule is then cached and reused for the next items. This bug can leak data to unauthorized users when the rule depends on the value of a property of the item. This bug can also hide properties that should be displayed to authorized users.

Patches

This issue impacts the 2.7, 3.0 and 3.1 branches. Upgrade to v2.7.10, v3.0.12 or v3.1.3.

Workarounds

Replace the cache_key of the context array of the Serializer inside a custom normalizer that works on objects if the security option of the ApiPlatform\Metadata\ApiProperty attribute is used.

Affected versions

v3.0.0v3.0.1v3.0.10v3.0.11v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9

+ 38 more Show less

v3.1.0v3.1.1v3.1.2v2.6.0v2.6.1v2.6.2v2.6.3v2.6.3-alpha.1v2.6.3.alphav2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.7.0v2.7.0-alpha.1v2.7.0-alpha.2v2.7.0-alpha.3v2.7.0-alpha.4v2.7.0-alpha.5v2.7.0-alpha.6v2.7.0-alpha.7v2.7.0-beta.1v2.7.0-beta.2v2.7.0-beta.3v2.7.0-beta.4v2.7.0-beta.5v2.7.0-rc.1v2.7.0-rc.2v2.7.1v2.7.2v2.7.3v2.7.4v2.7.5v2.7.6v2.7.7v2.7.8v2.7.9

Fixed in

2.7.103.0.123.1.3

References

https://github.com/api-platform/core/security/advisories/GHSA-vr2x-7687-h6qv
https://nvd.nist.gov/vuln/detail/CVE-2023-25575
https://github.com/api-platform/core/commit/5723d68369722feefeb11e42528d9580db5dd0fb
https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2023-25575.yaml
https://github.com/api-platform/core
https://github.com/api-platform/core/releases/tag/v2.7.10

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2019-1000011 GHSA-974j-wjxx-wggj Oct 14, 2019

Incorrect Access Control vulnerability in api-platform/core

6.5 / 10
Medium
Network Low Low None Unchanged None High None

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.

Affected versions

v2.2.0v2.2.1v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1

+ 4 more Show less

v2.3.2v2.3.3v2.3.4v2.3.5

Fixed in

2.2.102.3.6

References

https://nvd.nist.gov/vuln/detail/CVE-2019-1000011
https://github.com/api-platform/core/issues/2364
https://github.com/api-platform/core/pull/2441
https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2019-1000011.yaml

Updated Nov 08, 2023 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 4
minor 16
patch 284
pre 94

399 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More