API Platform Core does not call GraphQl securityAfterResolver
The advisory, in context
Summary
A security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in this clause: https://github.com/api-platform/core/pull/6444/files#diff-09e3c2cfe12a2ce65bd6c983c7ca6bfcf783f852b8d0554bb938e8ebf5e5fa65R56
PoC
Create a graphql endpoint with a security after resolver.
Impact
As this fallsback to security, the impact is there only when there's only a security after resolver and none inside security. The test at https://github.com/api-platform/core/pull/6444 is probably broken.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 3.3.8 before 3.3.15
Fixed in 3.3.15
7 explicitly affected versions
v3.3.10, v3.3.11, v3.3.12, v3.3.13, v3.3.14, v3.3.8, v3.3.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.3.8"
},
{
"fixed": "3.3.15"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v3.3.10",
"v3.3.11",
"v3.3.12",
"v3.3.13",
"v3.3.14",
"v3.3.8",
"v3.3.9"
]
}References
- https://github.com/api-platform/core/security/advisories/GHSA-7mxx-3cgm-xxv3
- https://nvd.nist.gov/vuln/detail/CVE-2025-23204
- https://github.com/api-platform/core/pull/6444
- https://github.com/api-platform/core/pull/6444/files#diff-09e3c2cfe12a2ce65bd6c983c7ca6bfcf783f852b8d0554bb938e8ebf5e5fa65R56
- https://github.com/api-platform/core/commit/dc4fc84ba93e22b4f44a37e90a93c6d079c1c620
- https://github.com/api-platform/core
- https://github.com/soyuka/core/blob/7e2e8f9ff322ac5f6eb5f65baf432bffdca0fd51/src/Symfony/Security/State/AccessCheckerProvider.php#L49-L57