TI-2023-10878 Aliases CVE-2023-25575 GHSA-vr2x-7687-h6qv

Secured properties in API Platform Core may be accessible within collections

LOW 35CWE-842Published 2023-02-28 · Updated 2025-03-07

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs. Resource properties secured with the `security` option of the `ApiPlatform\Metadata\ApiProperty` attribute can be disclosed to unauthorized users. The problem affects most serialization formats, including raw JSON, which is enabled by default when installing API Platform. Custom serialization formats may also be impacted. Only collection endpoints are affected by the issue, item endpoints are not. The JSON-LD format is not affected by the issue. The result of the security rule is only executed for the first item of the collection. The result of the rule is then cached and reused for the next items. This bug can leak data to unauthorized users when the rule depends on the value of a property of the item. This bug can also hide properties that should be displayed to authorized users. This issue impacts the 2.7, 3.0 and 3.1 branches. Please upgrade to versions 2.7.10, 3.0.12 or 3.1.3. As a workaround, replace the `cache_key` of the context array of the Serializer inside a custom normalizer that works on objects if the security option of the `ApiPlatform\Metadata\ApiProperty` attribute is used.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00604 49th percentileScored 2026-11-07

Fix Fixed core (api-platform): 3.0.12, 3.1.3, 2.7.10api-platform/core (Packagist): 3.0.12, 3.1.3, 2.7.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
api-platform	core	3.0.0 to before 3.0.12; 3.1.0 to before 3.1.3; 2.6.0 to before 2.7.10	3.0.12, 3.1.3, 2.7.10	Patch available	CNA
—	api-platform/core (Packagist)	3.0.0 to before 3.0.12	3.0.12	Patch available	GHSA-vr2x-7687-h6qv
—	api-platform/core (Packagist)	3.1.0 to before 3.1.3	3.1.3	Patch available	GHSA-vr2x-7687-h6qv
—	api-platform/core (Packagist)	2.6.0 to before 2.7.10	2.7.10	Patch available	GHSA-vr2x-7687-h6qv

core Vendorapi-platform Affected 3.0.0 to before 3.0.12; 3.1.0 to before 3.1.3; 2.6.0 to before 2.7.10 Fixed in 3.0.12, 3.1.3, 2.7.10 Patch available CNA
api-platform/core (Packagist) Vendor— Affected 3.0.0 to before 3.0.12 Fixed in 3.0.12 Patch available GHSA-vr2x-7687-h6qv
api-platform/core (Packagist) Vendor— Affected 3.1.0 to before 3.1.3 Fixed in 3.1.3 Patch available GHSA-vr2x-7687-h6qv
api-platform/core (Packagist) Vendor— Affected 2.6.0 to before 2.7.10 Fixed in 2.7.10 Patch available GHSA-vr2x-7687-h6qv

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:api-platform:core::::::::	2.6.0 to before 2.7.10; 3.0.0 to before 3.0.12; 3.1.0 to before 3.1.3	Vulnerable	api-platform

cpe:2.3:a:api-platform:core:*:*:*:*:*:*:*:* Versions 2.6.0 to before 2.7.10; 3.0.0 to before 3.0.12; 3.1.0 to before 3.1.3 Vulnerable ·api-platform

Remediation

Fix · CNA core (api-platform) Fixed in 3.0.12, 3.1.3, 2.7.10
Fix · GHSA-vr2x-7687-h6qv api-platform/core (Packagist) Fixed in 3.0.12 Advisory →
Fix · GHSA-vr2x-7687-h6qv api-platform/core (Packagist) Fixed in 3.1.3 Advisory →
Fix · GHSA-vr2x-7687-h6qv api-platform/core (Packagist) Fixed in 2.7.10 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-25575
2026-10-03 Alias added: GHSA-vr2x-7687-h6qv

References

Patch 1

https://github.com/api-platform/core/commit/5723d68369722feefeb11e42528d9580db5dd0fb

Advisory 2

Other 5

TI-2019-15828 API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control… CVSS 3.0MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences