API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control…
Priority LOW 31CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284.
Summary
API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.
Why it matters now
EPSS 0.01024 63rd percentileScored 2026-11-07
Fix Fixed api-platform/core (Packagist): 2.2.10, 2.3.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | api-platform/core (Packagist) | 2.2.0 to before 2.2.10 | 2.2.10 | Patch available | GHSA-974j-wjxx-wggj |
| — | api-platform/core (Packagist) | 2.3.0 to before 2.3.6 | 2.3.6 | Patch available | GHSA-974j-wjxx-wggj |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- api-platform/core (Packagist) Vendor— Affected 2.2.0 to before 2.2.10 Fixed in 2.2.10 Patch available GHSA-974j-wjxx-wggj
- api-platform/core (Packagist) Vendor— Affected 2.3.0 to before 2.3.6 Fixed in 2.3.6 Patch available GHSA-974j-wjxx-wggj
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:api-platform:core:*:*:*:*:*:*:*:* | 2.2.0 – 2.3.5 | Vulnerable | api-platform |
- cpe:2.3:a:api-platform:core:*:*:*:*:*:*:*:* Versions 2.2.0 – 2.3.5 Vulnerable ·api-platform
Remediation
- Fix · GHSA-974j-wjxx-wggj api-platform/core (Packagist) Fixed in 2.2.10 Advisory →
- Fix · GHSA-974j-wjxx-wggj api-platform/core (Packagist) Fixed in 2.3.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-1000011
- 2026-10-03 Alias added: GHSA-974j-wjxx-wggj
References
More api-platform Core vulnerabilities
- TI-2023-10878 Secured properties in API Platform Core may be accessible within collections CVSS 3.1HIGH 7.7
Sources
- CVE-2019-1000011 · CVE Program
- CVE-2019-1000011 · NVD
- FIRST EPSS
- GHSA-974j-wjxx-wggj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences