Vulnerabilities

TI-2026-36762 CVE-2026-49858 · GHSA-pjhx-3c3w-9v23

API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

LOW 26

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00315 Published 2026-07-01 Fixed in 4.1.29, 4.2.25 +1 CWE-524

TI-2026-39072 CVE-2026-54164 · GHSA-9rjg-x2p2-h68h

API Platform Core: Missing IRI type check enables resource type confusion

MEDIUM 62

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00336 Published 2026-07-01 Fixed in 4.1.30, 4.2.26 +1 CWE-843

TI-2025-22666 CVE-2025-31485 · GHSA-428q-q3vv-3fq3

GraphQL grant on a property might be cached with different objects

MEDIUM 40

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00626 Published 2025-04-03 Fixed in 4.0.22, 3.4.17 +1 CWE-696

TI-2025-22662 CVE-2025-31481 · GHSA-cg3c-245w-728m

GraphQL query operations security can be bypassed

HIGH 72

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00475 Published 2025-04-03 Fixed in 4.0.22, 3.4.17 +1 CWE-863

TI-2023-25779 CVE-2023-47639 · GHSA-rfw5-cqjj-7v9r

API Platform Core can leak exceptions message that may contain sensitive information

MEDIUM 63

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00387 Published 2025-04-03 Fixed in 3.2.5 CWE-209

TI-2025-16989 CVE-2025-23204 · GHSA-7mxx-3cgm-xxv3

GraphQl securityAfterResolver not called

MEDIUM 54

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00301 Published 2025-03-24 Fixed in 3.3.15 CWE-20

TI-2023-10878 CVE-2023-25575 · GHSA-vr2x-7687-h6qv

Secured properties in API Platform Core may be accessible within collections

LOW 35

API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00604 Published 2023-02-28 Fixed in 3.0.12, 3.1.3 +1 CWE-842

TI-2019-15828 CVE-2019-1000011 · GHSA-974j-wjxx-wggj

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control…

LOW 31

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01024 Published 2019-02-04 Fixed in 2.2.10, 2.3.6 CWE-284

Vulnerabilities

Filters