CVE-2025-31481: API Platform Core Auth Bypass Vulnerability

CVE-2025-31481 Overview

CVE-2025-31481 is an authorization bypass vulnerability [CWE-863] in API Platform Core, a framework for building hypermedia-driven REST and GraphQL APIs. The flaw resides in the GraphQL Relay node implementation, where attackers can query the special Relay node type to retrieve resources while bypassing the security expressions configured on the target operation. The maintainers addressed the issue in versions 4.0.22 and 3.4.17 by introducing a RuntimeOperationMetadataFactory that resolves the underlying operation and enforces its security checks during Relay node resolution.

Critical Impact
Unauthenticated remote attackers can read protected GraphQL resources by querying them through the Relay node interface, bypassing per-operation security rules.

Affected Products

API Platform Core versions prior to 3.4.17 (3.x branch)
API Platform Core versions prior to 4.0.22 (4.x branch)
Applications exposing GraphQL endpoints built on API Platform with the Relay node interface enabled

Discovery Timeline

2025-04-03 - CVE-2025-31481 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-31481

Vulnerability Analysis

API Platform exposes a GraphQL schema that implements the Relay specification, including the global node(id: ID!) field used to fetch any object by its opaque identifier. Operation-level security is normally enforced through security and securityPostDenormalize expressions declared on each resource operation. The Relay node resolver did not consult these per-operation expressions when materializing a resource through the global node interface.

An attacker who can guess or enumerate a valid global ID can therefore request restricted resources without triggering the configured access control. The result is an information disclosure path that subverts the authorization model of the API. The CWE-863 classification (Incorrect Authorization) reflects that authentication may pass but the authorization check applicable to the target operation is never evaluated.

Root Cause

The ResolverFactory responsible for Relay node resolution did not inject an OperationMetadataFactoryInterface to look up the GraphQL operation associated with the requested resource. Without that lookup, the resolver could not apply the operation's security voters and proceeded to return the object directly from the state provider. The fix raises this dependency to a required argument and throws InvalidArgumentException when it is missing.

Attack Vector

Exploitation requires only network access to the GraphQL endpoint. An attacker issues a standard Relay node query referencing the encoded global identifier of a protected resource. Because no authentication or user interaction is required, automated enumeration against exposed APIs is straightforward.

php

// Security patch: src/GraphQl/Resolver/Factory/ResolverFactory.php
use ApiPlatform\Metadata\Exception\InvalidArgumentException;
use ApiPlatform\Metadata\Operation\Factory\OperationMetadataFactoryInterface;
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;

class ResolverFactory implements ResolverFactoryInterface
{
    public function __construct(
        private readonly ProviderInterface $provider,
        private readonly ProcessorInterface $processor,
        private readonly ?OperationMetadataFactoryInterface $operationMetadataFactory = null,
    ) {
        if (!$operationMetadataFactory) {
            throw new InvalidArgumentException(\sprintf(
                'Not injecting the "%s" exposes Relay nodes to a security risk.',
                OperationMetadataFactoryInterface::class
            ));
        }
    }
}

Source: GitHub commit 55712452

Detection Methods for CVE-2025-31481

Indicators of Compromise

GraphQL requests to /graphql invoking the node(id: ...) field with base64-encoded global IDs targeting resources the requester is not authorized to access
Successful 200 responses returning fields from resources whose REST endpoints would otherwise return 401 or 403
Sequential or scripted enumeration of Relay global IDs from a single client or IP address

Detection Strategies

Compare authorization outcomes between REST operations and equivalent GraphQL node queries for the same underlying resource; divergence indicates the bypass is being exercised
Instrument GraphQL middleware to log the resolved operation name and effective security expression for every Relay node lookup
Alert when anonymous or low-privilege sessions successfully resolve node queries against resource types annotated with security expressions

Monitoring Recommendations

Capture full GraphQL request bodies in application logs and forward them to a centralized analytics pipeline for query-pattern review
Track the volume of node queries per source identity and rate-limit clients that issue ID enumeration patterns
Review web server access logs for spikes in POST requests to GraphQL endpoints following the April 2025 disclosure window

How to Mitigate CVE-2025-31481

Immediate Actions Required

Upgrade API Platform Core to 3.4.17 for the 3.x branch or 4.0.22 for the 4.x branch
Audit GraphQL resources that rely on operation-level security expressions and verify each is reachable only through authorized operations after upgrade
Rotate or invalidate any credentials or tokens that may have been exposed through queried protected resources

Patch Information

The maintainers shipped fixes in API Platform Core v3.4.17 and v4.0.22. The patches introduce a new RuntimeOperationMetadataFactory (see commit 55712452 and commit 60747cc8) that resolves the operation behind a Relay node and enforces its declared security expressions. Full technical context is in GHSA-cg3c-245w-728m.

Workarounds

Disable the Relay node interface in the GraphQL configuration until the upgrade can be deployed
Restrict the GraphQL endpoint to authenticated sessions at the web server or API gateway layer to reduce unauthenticated exposure
Add resource-level access checks in state providers as a defense-in-depth measure independent of operation metadata

bash

# Upgrade API Platform Core via Composer
composer require api-platform/core:^3.4.17
# or, for the 4.x branch
composer require api-platform/core:^4.0.22

# Verify installed version
composer show api-platform/core | grep versions