CVE-2025-23204 GraphQl securityAfterResolver not called
Attackers can bypass GraphQL security checks when only post-resolver security is configured, potentially accessing unauthorized data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-23204?
CVE-2025-23204 is a medium-severity missing authorization vulnerability in api-platform core, published on 24 Mar 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As this falls back to `security`, the impact is there only when there's only a security after resolver and none inside security. Version 3.3.15 contains a patch for the issue.
Weakness: CWE-20
Which versions are affected by CVE-2025-23204?
2 open source packages ship an affected version, including api-platform/core.
| Package | Affected | Fixed in |
|---|---|---|
api-platform/core Packagist | From 3.3.8 | 3.3.15 |
api-platform/core Packagist | From 3.3.8 | 3.3.15 |
How do I fix CVE-2025-23204?
Upgrade api-platform/core to 3.3.15 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-23204 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-23204 exists.
Sources
Also known as GHSA-7mxx-3cgm-xxv3.