CVE-2025-23204

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As this falls back to `security`, the impact is there only when there's only a security after resolver and none inside security. Version 3.3.15 contains a patch for the issue.

• CWE-20

• https://github.com/api-platform/core/commit/dc4fc84ba93e22b4f44a37e90a93c6d079c1c620
• https://github.com/api-platform/core/pull/6444
• https://github.com/api-platform/core/pull/6444/files#diff-09e3c2cfe12a2ce65bd6c983c7ca6bfcf783f852b8d0554bb938e8ebf5e5fa65R56
• https://github.com/api-platform/core/security/advisories/GHSA-7mxx-3cgm-xxv3
• https://github.com/soyuka/core/blob/7e2e8f9ff322ac5f6eb5f65baf432bffdca0fd51/src/Symfony/Security/State/AccessCheckerProvider.php#L49-L57

Published

Mar 24, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-23199librenms is a community-based GPL-licensed network monitorin…5.4
• CVE-2025-2320A vulnerability has been found in 274056675 springboot-opena…9.8
• CVE-2025-23200librenms is a community-based GPL-licensed network monitorin…5.4
• CVE-2025-23201librenms is a community-based GPL-licensed network monitorin…6.1
• CVE-2025-23202Bible Module is a tool designed for ROBLOX developers to int…10
• CVE-2025-23203Icinga Director is an Icinga config deployment tool. A Secur…5.5
• CVE-2025-23205nbgrader is a system for assigning and grading notebooks. En…6.9
• CVE-2025-23206The AWS Cloud Development Kit (AWS CDK) is an open-source so…8.1
• CVE-2025-23207KaTeX is a fast, easy-to-use JavaScript library for TeX math…7.2
• CVE-2025-23208zot is a production-ready vendor-neutral OCI image registry.…5.3
• CVE-2025-23209Craft is a flexible, user-friendly CMS for creating custom d…8.1
• CVE-2025-2321A vulnerability was found in 274056675 springboot-openai-cha…6.5