CVE-2025-31485

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17.

• CWE-696

• https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8
• https://github.com/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a
• https://github.com/api-platform/core/releases/tag/v3.4.17
• https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3

Published

Apr 3, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-3148A vulnerability was found in codeprojects Product Management…7.8
• CVE-2025-31480aiven-extras is a PostgreSQL extension. This is a privilege …9.1
• CVE-2025-31481API Platform Core is a system to create hypermedia-driven RE…7.5
• CVE-2025-31482FreshRSS is a self-hosted RSS feed aggregator. A vulnerabili…4.3
• CVE-2025-31483Miniflux is a feed reader. Due to a weak Content Security Po…4.8
• CVE-2025-31484conda-forge infrastructure holds common configurations and s…9.3
• CVE-2025-31486Vite is a frontend tooling framework for javascript. The con…5.3
• CVE-2025-31487The XWiki JIRA extension provides various integration points…7.7
• CVE-2025-31488Plain Craft Launcher (PCL) is a launcher for Minecraft. PCL …4.9
• CVE-2025-31489MinIO is a High Performance Object Storage released under GN…8.7
• CVE-2025-3149A vulnerability was found in itning Student Homework Managem…4.8
• CVE-2025-31490AutoGPT is a platform that allows users to create, deploy, a…7.5