GraphQL grant on a property might be cached with different objects
The advisory, in context
Original message:
I found an issue with security grants on on properties in the GraphQL ItemNormalizer:
If you use something like #[ApiProperty(security: 'is_granted("PROPERTY_READ", [object, property])')] on a member of an entity, the grant gets cached and is only evaluated once, even if the object in question is a different one.
There is the ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method that seems to be intended to prevent this: https://github.com/api-platform/core/blob/88f5ac50d20d6510686a7552310cc567fcca45bf/src/GraphQl/Serializer/ItemNormalizer.php#L160-L164
and in its usage on line 90 it does indeed not create a cache key, but the parent::normalize() that is called afterwards still creates the cache key and causes the issue.
Impact
It grants access to properties that it should not.
Workarounds
Override the ItemNormalizer.
Patched at: https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 4.0.0-alpha.1 before 4.0.22
Fixed in 4.0.22
31 explicitly affected versions
v4.0.0, v4.0.0-alpha.1, v4.0.0-alpha.2, v4.0.0-alpha.3, v4.0.0-alpha.4, v4.0.0-alpha.5, v4.0.0-alpha.6, v4.0.0-alpha.7, v4.0.0-beta.1, v4.0.0-beta.2, v4.0.1, v4.0.10, v4.0.11, v4.0.12, v4.0.13, v4.0.14, v4.0.15, v4.0.16, v4.0.17, v4.0.18, v4.0.19, v4.0.2, v4.0.20, v4.0.21, v4.0.3, v4.0.4, v4.0.5, v4.0.6, v4.0.7, v4.0.8, v4.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.0.0-alpha.1"
},
{
"fixed": "4.0.22"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v4.0.0",
"v4.0.0-alpha.1",
"v4.0.0-alpha.2",
"v4.0.0-alpha.3",
"v4.0.0-alpha.4",
"v4.0.0-alpha.5",
"v4.0.0-alpha.6",
"v4.0.0-alpha.7",
"v4.0.0-beta.1",
"v4.0.0-beta.2",
"v4.0.1",
"v4.0.10",
"v4.0.11",
"v4.0.12",
"v4.0.13",
"v4.0.14",
"v4.0.15",
"v4.0.16",
"v4.0.17",
"v4.0.18",
"v4.0.19",
"v4.0.2",
"v4.0.20",
"v4.0.21",
"v4.0.3",
"v4.0.4",
"v4.0.5",
"v4.0.6",
"v4.0.7",
"v4.0.8",
"v4.0.9"
]
}From 4.0.0-alpha.1 before 4.0.22
Fixed in 4.0.22
31 explicitly affected versions
v4.0.0, v4.0.0-alpha.1, v4.0.0-alpha.2, v4.0.0-alpha.3, v4.0.0-alpha.4, v4.0.0-alpha.5, v4.0.0-alpha.6, v4.0.0-alpha.7, v4.0.0-beta.1, v4.0.0-beta.2, v4.0.1, v4.0.10, v4.0.11, v4.0.12, v4.0.13, v4.0.14, v4.0.15, v4.0.16, v4.0.17, v4.0.18, v4.0.19, v4.0.2, v4.0.20, v4.0.21, v4.0.3, v4.0.4, v4.0.5, v4.0.6, v4.0.7, v4.0.8, v4.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.0.0-alpha.1"
},
{
"fixed": "4.0.22"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v4.0.0",
"v4.0.0-alpha.1",
"v4.0.0-alpha.2",
"v4.0.0-alpha.3",
"v4.0.0-alpha.4",
"v4.0.0-alpha.5",
"v4.0.0-alpha.6",
"v4.0.0-alpha.7",
"v4.0.0-beta.1",
"v4.0.0-beta.2",
"v4.0.1",
"v4.0.10",
"v4.0.11",
"v4.0.12",
"v4.0.13",
"v4.0.14",
"v4.0.15",
"v4.0.16",
"v4.0.17",
"v4.0.18",
"v4.0.19",
"v4.0.2",
"v4.0.20",
"v4.0.21",
"v4.0.3",
"v4.0.4",
"v4.0.5",
"v4.0.6",
"v4.0.7",
"v4.0.8",
"v4.0.9"
]
}Earlier releases before 3.4.17
Fixed in 3.4.17
50 explicitly affected versions
v3.2.0-beta.1, v3.2.1, v3.2.10, v3.2.11, v3.2.12, v3.2.2, v3.2.25, v3.2.3, v3.2.4, v3.2.5, v3.2.6, v3.2.7, v3.2.8, v3.2.9, v3.3.0-alpha.1, v3.3.0-beta.1, v3.3.11, v3.3.13, v3.3.14, v3.3.15, v3.3.3, v3.3.4, v3.3.6, v3.3.7, v3.3.8, v3.3.9, v3.4.0, v3.4.0-alpha.1, v3.4.0-alpha.2, v3.4.0-alpha.3, v3.4.0-alpha.4, v3.4.0-alpha.5, v3.4.0-alpha.6, v3.4.0-alpha.7, v3.4.0-beta.1, v3.4.1, v3.4.10, v3.4.11, v3.4.13, v3.4.14, v3.4.15, v3.4.16, v3.4.2, v3.4.3, v3.4.4, v3.4.5, v3.4.6, v3.4.7, v3.4.8, v3.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.17"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v3.2.0-beta.1",
"v3.2.1",
"v3.2.10",
"v3.2.11",
"v3.2.12",
"v3.2.2",
"v3.2.25",
"v3.2.3",
"v3.2.4",
"v3.2.5",
"v3.2.6",
"v3.2.7",
"v3.2.8",
"v3.2.9",
"v3.3.0-alpha.1",
"v3.3.0-beta.1",
"v3.3.11",
"v3.3.13",
"v3.3.14",
"v3.3.15",
"v3.3.3",
"v3.3.4",
"v3.3.6",
"v3.3.7",
"v3.3.8",
"v3.3.9",
"v3.4.0",
"v3.4.0-alpha.1",
"v3.4.0-alpha.2",
"v3.4.0-alpha.3",
"v3.4.0-alpha.4",
"v3.4.0-alpha.5",
"v3.4.0-alpha.6",
"v3.4.0-alpha.7",
"v3.4.0-beta.1",
"v3.4.1",
"v3.4.10",
"v3.4.11",
"v3.4.13",
"v3.4.14",
"v3.4.15",
"v3.4.16",
"v3.4.2",
"v3.4.3",
"v3.4.4",
"v3.4.5",
"v3.4.6",
"v3.4.7",
"v3.4.8",
"v3.4.9"
]
}Earlier releases before 3.4.17
Fixed in 3.4.17
252 explicitly affected versions
v1.0.0, v1.0.0-beta, v1.0.0-beta.2, v1.0.0-beta.3, v1.0.1, v1.1.0, v1.1.0-beta.1, v1.1.0-beta.2, v1.1.1, v2.0.0, v2.0.0-alpha.1, v2.0.0-alpha.2, v2.0.0-beta.1, v2.0.0-beta.2, v2.0.0-beta.3, v2.0.0-rc.1, v2.0.0-rc.2, v2.0.0-rc.3, v2.0.0-rc.4, v2.0.0-rc.5, v2.0.0-rc.6, v2.0.1, v2.0.10, v2.0.11, v2.0.2, v2.0.3, v2.0.4, v2.0.5, v2.0.6, v2.0.7, v2.0.8, v2.0.9, v2.1.0, v2.1.0-beta.1, v2.1.0-beta.2, v2.1.1, v2.1.2, v2.1.3, v2.1.4, v2.1.5, v2.1.6, v2.2.0, v2.2.0-beta.1, v2.2.0-beta.2, v2.2.1, v2.2.10, v2.2.2, v2.2.3, v2.2.4, v2.2.5, v2.2.6, v2.2.7, v2.2.8, v2.2.9, v2.3.0, v2.3.0-beta.1, v2.3.1, v2.3.2, v2.3.3, v2.3.4, v2.3.5, v2.3.6, v2.4.0, v2.4.0-beta.1, v2.4.0-beta.2, v2.4.1, v2.4.2, v2.4.3, v2.4.4, v2.4.5, v2.4.6, v2.4.7, v2.5.0, v2.5.0-beta.1, v2.5.0-beta.2, v2.5.1, v2.5.10, v2.5.2, v2.5.3, v2.5.4, v2.5.5, v2.5.6, v2.5.7, v2.5.8, v2.5.9, v2.6.0, v2.6.0-alpha.1, v2.6.0-beta.1, v2.6.1, v2.6.2, v2.6.3, v2.6.3-alpha.1, v2.6.3.alpha, v2.6.4, v2.6.5, v2.6.6, v2.6.7, v2.6.8, v2.7.0, v2.7.0-alpha.1, v2.7.0-alpha.2, v2.7.0-alpha.3, v2.7.0-alpha.4, v2.7.0-alpha.5, v2.7.0-alpha.6, v2.7.0-alpha.7, v2.7.0-beta.1, v2.7.0-beta.2, v2.7.0-beta.3, v2.7.0-beta.4, v2.7.0-beta.5, v2.7.0-rc.1, v2.7.0-rc.2, v2.7.1, v2.7.10, v2.7.11, v2.7.12, v2.7.13, v2.7.14, v2.7.15, v2.7.16, v2.7.17, v2.7.18, v2.7.2, v2.7.3, v2.7.4, v2.7.5, v2.7.6, v2.7.7, v2.7.8, v2.7.9, v3.0.0, v3.0.0-beta.1, v3.0.0-beta.2, v3.0.0-rc.1, v3.0.0-rc.2, v3.0.1, v3.0.10, v3.0.11, v3.0.12, v3.0.2, v3.0.3, v3.0.4, v3.0.5, v3.0.6, v3.0.7, v3.0.8, v3.0.9, v3.1.0, v3.1.1, v3.1.10, v3.1.11, v3.1.12, v3.1.13, v3.1.14, v3.1.15, v3.1.16, v3.1.17, v3.1.18, v3.1.19, v3.1.2, v3.1.20, v3.1.21, v3.1.22, v3.1.23, v3.1.24, v3.1.25, v3.1.26, v3.1.27, v3.1.28, v3.1.29, v3.1.3, v3.1.4, v3.1.5, v3.1.6, v3.1.7, v3.1.8, v3.1.9, v3.2.0, v3.2.0-alpha.1, v3.2.0-alpha.2, v3.2.0-beta.1, v3.2.0-beta.2, v3.2.1, v3.2.10, v3.2.11, v3.2.12, v3.2.13, v3.2.14, v3.2.15, v3.2.16, v3.2.17, v3.2.18, v3.2.19, v3.2.2, v3.2.20, v3.2.21, v3.2.22, v3.2.23, v3.2.24, v3.2.25, v3.2.26, v3.2.3, v3.2.4, v3.2.5, v3.2.6, v3.2.7, v3.2.8, v3.2.9, v3.3.0, v3.3.0-alpha.1, v3.3.0-alpha.2, v3.3.0-beta.1, v3.3.0-beta.2, v3.3.1, v3.3.10, v3.3.11, v3.3.12, v3.3.13, v3.3.14, v3.3.15, v3.3.2, v3.3.3, v3.3.4, v3.3.5, v3.3.6, v3.3.7, v3.3.8, v3.3.9, v3.4.0, v3.4.0-alpha.1, v3.4.0-alpha.2, v3.4.0-alpha.3, v3.4.0-alpha.4, v3.4.0-alpha.5, v3.4.0-alpha.6, v3.4.0-alpha.7, v3.4.0-beta.1, v3.4.1, v3.4.10, v3.4.11, v3.4.14, v3.4.15, v3.4.16, v3.4.2, v3.4.3, v3.4.4, v3.4.5, v3.4.6, v3.4.7, v3.4.8, v3.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.17"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v1.0.0",
"v1.0.0-beta",
"v1.0.0-beta.2",
"v1.0.0-beta.3",
"v1.0.1",
"v1.1.0",
"v1.1.0-beta.1",
"v1.1.0-beta.2",
"v1.1.1",
"v2.0.0",
"v2.0.0-alpha.1",
"v2.0.0-alpha.2",
"v2.0.0-beta.1",
"v2.0.0-beta.2",
"v2.0.0-beta.3",
"v2.0.0-rc.1",
"v2.0.0-rc.2",
"v2.0.0-rc.3",
"v2.0.0-rc.4",
"v2.0.0-rc.5",
"v2.0.0-rc.6",
"v2.0.1",
"v2.0.10",
"v2.0.11",
"v2.0.2",
"v2.0.3",
"v2.0.4",
"v2.0.5",
"v2.0.6",
"v2.0.7",
"v2.0.8",
"v2.0.9",
"v2.1.0",
"v2.1.0-beta.1",
"v2.1.0-beta.2",
"v2.1.1",
"v2.1.2",
"v2.1.3",
"v2.1.4",
"v2.1.5",
"v2.1.6",
"v2.2.0",
"v2.2.0-beta.1",
"v2.2.0-beta.2",
"v2.2.1",
"v2.2.10",
"v2.2.2",
"v2.2.3",
"v2.2.4",
"v2.2.5",
"v2.2.6",
"v2.2.7",
"v2.2.8",
"v2.2.9",
"v2.3.0",
"v2.3.0-beta.1",
"v2.3.1",
"v2.3.2",
"v2.3.3",
"v2.3.4",
"v2.3.5",
"v2.3.6",
"v2.4.0",
"v2.4.0-beta.1",
"v2.4.0-beta.2",
"v2.4.1",
"v2.4.2",
"v2.4.3",
"v2.4.4",
"v2.4.5",
"v2.4.6",
"v2.4.7",
"v2.5.0",
"v2.5.0-beta.1",
"v2.5.0-beta.2",
"v2.5.1",
"v2.5.10",
"v2.5.2",
"v2.5.3",
"v2.5.4",
"v2.5.5",
"v2.5.6",
"v2.5.7",
"v2.5.8",
"v2.5.9",
"v2.6.0",
"v2.6.0-alpha.1",
"v2.6.0-beta.1",
"v2.6.1",
"v2.6.2",
"v2.6.3",
"v2.6.3-alpha.1",
"v2.6.3.alpha",
"v2.6.4",
"v2.6.5",
"v2.6.6",
"v2.6.7",
"v2.6.8",
"v2.7.0",
"v2.7.0-alpha.1",
"v2.7.0-alpha.2",
"v2.7.0-alpha.3",
"v2.7.0-alpha.4",
"v2.7.0-alpha.5",
"v2.7.0-alpha.6",
"v2.7.0-alpha.7",
"v2.7.0-beta.1",
"v2.7.0-beta.2",
"v2.7.0-beta.3",
"v2.7.0-beta.4",
"v2.7.0-beta.5",
"v2.7.0-rc.1",
"v2.7.0-rc.2",
"v2.7.1",
"v2.7.10",
"v2.7.11",
"v2.7.12",
"v2.7.13",
"v2.7.14",
"v2.7.15",
"v2.7.16",
"v2.7.17",
"v2.7.18",
"v2.7.2",
"v2.7.3",
"v2.7.4",
"v2.7.5",
"v2.7.6",
"v2.7.7",
"v2.7.8",
"v2.7.9",
"v3.0.0",
"v3.0.0-beta.1",
"v3.0.0-beta.2",
"v3.0.0-rc.1",
"v3.0.0-rc.2",
"v3.0.1",
"v3.0.10",
"v3.0.11",
"v3.0.12",
"v3.0.2",
"v3.0.3",
"v3.0.4",
"v3.0.5",
"v3.0.6",
"v3.0.7",
"v3.0.8",
"v3.0.9",
"v3.1.0",
"v3.1.1",
"v3.1.10",
"v3.1.11",
"v3.1.12",
"v3.1.13",
"v3.1.14",
"v3.1.15",
"v3.1.16",
"v3.1.17",
"v3.1.18",
"v3.1.19",
"v3.1.2",
"v3.1.20",
"v3.1.21",
"v3.1.22",
"v3.1.23",
"v3.1.24",
"v3.1.25",
"v3.1.26",
"v3.1.27",
"v3.1.28",
"v3.1.29",
"v3.1.3",
"v3.1.4",
"v3.1.5",
"v3.1.6",
"v3.1.7",
"v3.1.8",
"v3.1.9",
"v3.2.0",
"v3.2.0-alpha.1",
"v3.2.0-alpha.2",
"v3.2.0-beta.1",
"v3.2.0-beta.2",
"v3.2.1",
"v3.2.10",
"v3.2.11",
"v3.2.12",
"v3.2.13",
"v3.2.14",
"v3.2.15",
"v3.2.16",
"v3.2.17",
"v3.2.18",
"v3.2.19",
"v3.2.2",
"v3.2.20",
"v3.2.21",
"v3.2.22",
"v3.2.23",
"v3.2.24",
"v3.2.25",
"v3.2.26",
"v3.2.3",
"v3.2.4",
"v3.2.5",
"v3.2.6",
"v3.2.7",
"v3.2.8",
"v3.2.9",
"v3.3.0",
"v3.3.0-alpha.1",
"v3.3.0-alpha.2",
"v3.3.0-beta.1",
"v3.3.0-beta.2",
"v3.3.1",
"v3.3.10",
"v3.3.11",
"v3.3.12",
"v3.3.13",
"v3.3.14",
"v3.3.15",
"v3.3.2",
"v3.3.3",
"v3.3.4",
"v3.3.5",
"v3.3.6",
"v3.3.7",
"v3.3.8",
"v3.3.9",
"v3.4.0",
"v3.4.0-alpha.1",
"v3.4.0-alpha.2",
"v3.4.0-alpha.3",
"v3.4.0-alpha.4",
"v3.4.0-alpha.5",
"v3.4.0-alpha.6",
"v3.4.0-alpha.7",
"v3.4.0-beta.1",
"v3.4.1",
"v3.4.10",
"v3.4.11",
"v3.4.14",
"v3.4.15",
"v3.4.16",
"v3.4.2",
"v3.4.3",
"v3.4.4",
"v3.4.5",
"v3.4.6",
"v3.4.7",
"v3.4.8",
"v3.4.9"
]
}From 4.1.0-alpha.1 before 4.1.5
Fixed in 4.1.5
9 explicitly affected versions
v4.1.0, v4.1.0-alpha.1, v4.1.0-alpha.2, v4.1.0-beta.1, v4.1.0-beta.2, v4.1.1, v4.1.2, v4.1.3, v4.1.4
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.1.0-alpha.1"
},
{
"fixed": "4.1.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v4.1.0",
"v4.1.0-alpha.1",
"v4.1.0-alpha.2",
"v4.1.0-beta.1",
"v4.1.0-beta.2",
"v4.1.1",
"v4.1.2",
"v4.1.3",
"v4.1.4"
]
}From 4.1.0-alpha.1 before 4.1.5
Fixed in 4.1.5
9 explicitly affected versions
v4.1.0, v4.1.0-alpha.1, v4.1.0-alpha.2, v4.1.0-beta.1, v4.1.0-beta.2, v4.1.1, v4.1.2, v4.1.3, v4.1.4
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.1.0-alpha.1"
},
{
"fixed": "4.1.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v4.1.0",
"v4.1.0-alpha.1",
"v4.1.0-alpha.2",
"v4.1.0-beta.1",
"v4.1.0-beta.2",
"v4.1.1",
"v4.1.2",
"v4.1.3",
"v4.1.4"
]
}References
- https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3
- https://nvd.nist.gov/vuln/detail/CVE-2025-31485
- https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8
- https://github.com/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a
- https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31485.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31485.yaml
- https://github.com/api-platform/core
- https://github.com/api-platform/core/releases/tag/v3.4.17