CVE-2025-31481: Api platform/graphql GraphQL Query Operations Security Can Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-cg3c-245w-728m",
  "modified" : "2025-08-29T21:07:09Z",
  "published" : "2025-04-04T14:07:20Z",
  "aliases" : [ "CVE-2025-31481" ],
  "summary" : "GraphQL query operations security can be bypassed",
  "details" : "### Summary\n\nUsing the Relay special `node` type you can bypass the configured security on an operation.\n\n### Details\n\nHere is an example of how to apply security configurations for the GraphQL operations:\n\n```php\n#[ApiResource(\n    security: \"is_granted('ROLE_USER')\",\n    operations: [ /* ... */ ],\n    graphQlOperations: [\n        new Query(security: \"is_granted('ROLE_USER')\"),\n        //...\n    ],\n)]\nclass Book { /* ... */ }\n```\n\nThis indeed checks `is_granted('ROLE_USER')` as expected for a GraphQL query like the following:\n\n```php\n‌query {\n    book(id: \"/books/1\") {\n        title\n    }\n}\n```\n\nBut the security check can be bypassed by using the `node` field (that is available by default) on the root query type like that:\n\n```php\n‌query {\n    node(id: \"/books/1\") {\n        ... on Book {\n            title\n        }\n    }\n}\n```\n\nThis does not execute any security checks and can therefore be used to access any entity without restrictions by everyone that has access to the API.\n\n### Impact\n\nEveryone using GraphQl with the `security` attribute. Not sure whereas this works with custom resolvers nor if this also applies on mutation.\n\nPatched at https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "api-platform/graphql"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.0-alpha.1"
      }, {
        "fixed" : "4.0.22"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "api-platform/core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.0-alpha.1"
      }, {
        "fixed" : "4.0.22"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "api-platform/graphql"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.4.17"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "api-platform/core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.4.17"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "api-platform/graphql"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.1.0-alpha.1"
      }, {
        "fixed" : "4.1.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "api-platform/core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.1.0-alpha.1"
      }, {
        "fixed" : "4.1.5"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-31481"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31481.yaml"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31481.yaml"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/api-platform/core"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/api-platform/core/releases/tag/v3.4.17"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/api-platform/core/releases/tag/v4.1.5"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-863" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-04-04T14:07:20Z",
    "nvd_published_at" : "2025-04-03T20:15:25Z"
  }
}