https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T05:23:33.518786+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-224601 EUVD-2026-224601 2026-10-07T05:23:33.522305+00:00 EUVD-2026-224601 https://cve.radiocsirt.org/vuln/fkie_cve-2025-23204 fkie_cve-2025-23204 2026-10-07T05:23:33.522339+00:00

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As this falls back to `security`, the impact is there only when there's only a security after resolver and none inside security. Version 3.3.15 contains a patch for the issue.

 https://cve.radiocsirt.org/vuln/ghsa-7mxx-3cgm-xxv3 GHSA-7mxx-3cgm-xxv3 — API Platform Core does not call GraphQl securityAfterResolver 2026-10-07T05:23:33.522371+00:00

Affected: Packagist: api-platform/core

### Summary A security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in this clause: https://github.com/api-platform/core/pull/6444/files#diff-09e3c2cfe12a2ce65bd6c983c7ca6bfcf783f852b8d0554bb938e8ebf5e5fa65R56

https://github.com/soyuka/core/blob/7e2e8f9ff322ac5f6eb5f65baf432bffdca0fd51/src/Symfony/Security/State/AccessCheckerProvider.php#L49-L57

### PoC

Create a graphql endpoint with a security after resolver.

### Impact

As this fallsback to `security`, the impact is there only when there's only a security after resolver and none inside security. The test at https://github.com/api-platform/core/pull/6444 is probably broken.