CVE-2025-31481: 
PHP vulnerability analysis and mitigation

API Platform Core, a system for creating hypermedia-driven REST and GraphQL APIs, was found to have a security vulnerability (CVE-2025-31481) that allows bypassing configured security on operations using the Relay special node type. The vulnerability was discovered and disclosed on April 3, 2025, and affects versions prior to 4.0.22 and 3.4.17 (GitHub Advisory).

The vulnerability exists in the GraphQL implementation where security configurations can be circumvented. While normal GraphQL queries respect security checks like is_granted('ROLE_USER'), the security check can be bypassed by using the node field on the root query type. For example, instead of using a direct query like book(id: "/books/1"), an attacker can use node(id: "/books/1") to bypass security restrictions. The vulnerability has been assigned a CVSS v3.1 score of 7.5 (HIGH) with vector string AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (GitHub Advisory).

The vulnerability allows unauthorized access to any entity without restrictions by anyone who has access to the API. This particularly affects implementations using GraphQL with security attributes, potentially exposing sensitive data to unauthorized users (GitHub Advisory).

The vulnerability has been fixed in versions 4.0.22 and 3.4.17. Users are strongly advised to upgrade to these patched versions. The fix was implemented through commits 60747cc and 5571245 (GitHub Commits, GitHub Release).