api-platform/graphql

[READ ONLY] API Platform GraphQL component

View on Packagist

View on Github

Activity

Latest release: 1mo ago
Total releases: 112
Cadence: ~daily
Last 12 months: 54

Reach

Stars: 4

Details

License: MIT
First release: Sep 08, 2023

Releases

Version	Released
`v5.0.5` patch	Sep 29, 2026
`v5.0.4` patch	Sep 29, 2026
`v5.0.3` patch	Sep 29, 2026
`v5.0.2` patch	Sep 29, 2026
`v4.4.6` patch	Sep 28, 2026
`v4.4.5` patch	Sep 28, 2026
`v4.4.4` patch	Sep 28, 2026
`v4.4.3` patch	Sep 28, 2026
`v5.0.1` patch	Sep 25, 2026
`v4.4.2` patch	Sep 25, 2026
`v5.0.0` major	Sep 16, 2026
`v4.4.1` patch	Sep 16, 2026
`v4.4.0` minor	Sep 16, 2026
`v5.0.0-beta.2` pre	Sep 15, 2026
`v5.0.0-beta.1` pre	Sep 12, 2026
`v4.4.0-beta.3` pre	Sep 12, 2026
`v4.4.0-beta.1` pre	Sep 12, 2026
`v4.4.0-beta.2` pre	Sep 12, 2026
`v5.0.0-alpha.3` pre	Aug 16, 2026
`v4.4.0-alpha.4` pre	Aug 16, 2026
`v4.3.21` patch	Aug 16, 2026
`v4.3.20` patch	Aug 16, 2026
`v4.3.19` patch	Aug 16, 2026
`v4.3.18` patch	Aug 16, 2026
`v5.0.0-alpha.2` pre	Jul 12, 2026
`v4.4.0-alpha.3` pre	Jul 12, 2026
`v5.0.0-alpha.1` pre	Jun 29, 2026
`v4.4.0-alpha.2` pre	Jun 25, 2026
`v4.4.0-alpha.1` pre	Jun 23, 2026
`v4.3.17` patch	Jun 19, 2026
`v4.3.13` patch	Jun 13, 2026
`v4.2.26` patch	Jun 13, 2026
`v4.1.30` patch	Jun 13, 2026
`v4.3.11` patch	Jun 05, 2026
`v4.3.9` patch	Jun 04, 2026
`v4.3.8` patch	Jun 04, 2026
`v4.2.25` patch	Jun 04, 2026
`v4.3.7` patch	May 28, 2026
`v4.1.29` patch	May 27, 2026
`v4.3.6` patch	May 12, 2026
`v4.3.5` patch	Apr 30, 2026
`v4.3.3` patch	Mar 17, 2026
`v4.3.0` minor	Mar 06, 2026
`v4.3.0-beta.2` pre	Mar 06, 2026
`v4.3.0-beta.1` pre	Feb 27, 2026
`v4.2.24` patch	Feb 25, 2026
`v4.3.0-alpha.2` pre	Feb 13, 2026
`v4.2.17` patch	Feb 13, 2026
`v4.2.15` patch	Jan 26, 2026
`v4.2.14` patch	Jan 12, 2026

1–50 of 112

Repository

api-platform/graphql

Forks: 0
Open issues: 0
Language: PHP

api
api-platform
graphql
php

Dependencies (8)

Depends on

v5.0.5

Supply-chain exposure

Known CVEs (2)

CVE-2025-31485 GHSA-428q-q3vv-3fq3 Apr 04, 2025

GraphQL grant on a property might be cached with different objects

7.5 / 10
High
Network Low None None Unchanged High None None

Original message:

I found an issue with security grants on on properties in the GraphQL ItemNormalizer:

If you use something like #[ApiProperty(security: 'is_granted("PROPERTY_READ", [object, property])')] on a member of an entity, the grant gets cached and is only evaluated once, even if the object in question is a different one.

There is the ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method that seems to be intended to prevent this: https://github.com/api-platform/core/blob/88f5ac50d20d6510686a7552310cc567fcca45bf/src/GraphQl/Serializer/ItemNormalizer.php#L160-L164
and in its usage on line 90 it does indeed not create a cache key, but the parent::normalize() that is called afterwards still creates the cache key and causes the issue.

Impact

It grants access to properties that it should not.

Workarounds

Override the ItemNormalizer.

Patched at: https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8

Affected versions

v4.0.0v4.0.0-alpha.1v4.0.0-alpha.2v4.0.0-alpha.3v4.0.0-alpha.4v4.0.0-alpha.5v4.0.0-alpha.6v4.0.0-alpha.7v4.0.0-beta.1v4.0.0-beta.2v4.0.1v4.0.10

+ 78 more Show less

v4.0.11v4.0.12v4.0.13v4.0.14v4.0.15v4.0.16v4.0.17v4.0.18v4.0.19v4.0.2v4.0.20v4.0.21v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v3.2.0-beta.1v3.2.1v3.2.10v3.2.11v3.2.12v3.2.2v3.2.25v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0-alpha.1v3.3.0-beta.1v3.3.11v3.3.13v3.3.14v3.3.15v3.3.3v3.3.4v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.0-alpha.1v3.4.0-alpha.2v3.4.0-alpha.3v3.4.0-alpha.4v3.4.0-alpha.5v3.4.0-alpha.6v3.4.0-alpha.7v3.4.0-beta.1v3.4.1v3.4.10v3.4.11v3.4.13v3.4.14v3.4.15v3.4.16v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v4.1.0v4.1.0-alpha.1v4.1.0-alpha.2v4.1.0-beta.1v4.1.0-beta.2v4.1.1v4.1.2v4.1.3v4.1.4

Fixed in

3.4.174.0.224.1.5

References

https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3
https://nvd.nist.gov/vuln/detail/CVE-2025-31485
https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8
https://github.com/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a
https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31485.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31485.yaml

Updated Aug 29, 2025 · Source: OSV.dev
CVE-2025-31481 GHSA-cg3c-245w-728m Apr 04, 2025

GraphQL query operations security can be bypassed

7.5 / 10
High
Network Low None None Unchanged High None None

Summary

Using the Relay special node type you can bypass the configured security on an operation.

Details

Here is an example of how to apply security configurations for the GraphQL operations:

#[ApiResource( security: "is_granted('ROLE_USER')", operations: [ /* ... */ ], graphQlOperations: [ new Query(security: "is_granted('ROLE_USER')"), //... ], )] class Book { /* ... */ }

This indeed checks is_granted('ROLE_USER') as expected for a GraphQL query like the following:

‌query { book(id: "/books/1") { title } }

But the security check can be bypassed by using the node field (that is available by default) on the root query type like that:

‌query { node(id: "/books/1") { ... on Book { title } } }

This does not execute any security checks and can therefore be used to access any entity without restrictions by everyone that has access to the API.

Impact

Everyone using GraphQl with the security attribute. Not sure whereas this works with custom resolvers nor if this also applies on mutation.

Patched at https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568

Affected versions

v4.0.0v4.0.0-alpha.1v4.0.0-alpha.2v4.0.0-alpha.3v4.0.0-alpha.4v4.0.0-alpha.5v4.0.0-alpha.6v4.0.0-alpha.7v4.0.0-beta.1v4.0.0-beta.2v4.0.1v4.0.10

+ 78 more Show less

v4.0.11v4.0.12v4.0.13v4.0.14v4.0.15v4.0.16v4.0.17v4.0.18v4.0.19v4.0.2v4.0.20v4.0.21v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v3.2.0-beta.1v3.2.1v3.2.10v3.2.11v3.2.12v3.2.2v3.2.25v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0-alpha.1v3.3.0-beta.1v3.3.11v3.3.13v3.3.14v3.3.15v3.3.3v3.3.4v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.0-alpha.1v3.4.0-alpha.2v3.4.0-alpha.3v3.4.0-alpha.4v3.4.0-alpha.5v3.4.0-alpha.6v3.4.0-alpha.7v3.4.0-beta.1v3.4.1v3.4.10v3.4.11v3.4.13v3.4.14v3.4.15v3.4.16v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v4.1.0v4.1.0-alpha.1v4.1.0-alpha.2v4.1.0-beta.1v4.1.0-beta.2v4.1.1v4.1.2v4.1.3v4.1.4

Fixed in

3.4.174.0.224.1.5

References

https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m
https://nvd.nist.gov/vuln/detail/CVE-2025-31481
https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb
https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568
https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31481.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31481.yaml

Updated Aug 29, 2025 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 2
minor 6
patch 72
pre 31

112 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More