CVE-2025-23204

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As this falls back to `security`, the impact is there only when there's only a security after resolver and none inside security. Version 3.3.15 contains a patch for the issue.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Mar 24, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-232056.9nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extractCVE-2025-232068.1The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provisioCVE-2025-232077.2KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressionsCVE-2025-232085.3zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-lCVE-2025-232098.1Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE)CVE-2025-23216.5A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this issue is some unknown CVE-2025-232104.8phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a BypassCVE-2025-232119.9Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any CVE-2025-232126.5Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows anyCVE-2025-232135.4Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to uploaCVE-2025-232146.9Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. ByCVE-2025-232159.3PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in ja