CVE-2025-31485

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-696

Affected software

VendorProductVersions
api-platformcore>= 4.0.0-alpha.1, < 4.0.22; < 3.4.17

References

Timeline

Published
Apr 3, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-314865.3Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.CVE-2025-314877.7The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin). If the JIRA macro is instCVE-2025-314885.0Plain Craft Launcher (PCL) is a launcher for Minecraft. PCL allows users to use homepages provided by third parties. If controls such as WebCVE-2025-314898.7MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorizatiCVE-2025-31494.8A vulnerability was found in itning Student Homework Management System up to 1.2.7. It has been classified as problematic. Affected is an unCVE-2025-314907.5AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflCVE-2025-314918.6AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflCVE-2025-314928.2mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID CoCVE-2025-314939.1Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sitesCVE-2025-314943.5AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflCVE-2025-314967.5apollo-compiler is a query-based compiler for the GraphQL query language. Prior to 1.27.0, a vulnerability in Apollo Compiler allowed querieCVE-2025-314977.5TEIGarage is a webservice and RESTful service to transform, convert and validate various formats, focussing on the TEI format. The Document