{"action":"Upgrade api-platform/graphql to 3.4.17 or later.","affected":[{"fixed":"4.0.22","introduced":"4.0.0-alpha.1"},{"fixed":"3.4.17","introduced":"0"},{"fixed":"4.1.5","introduced":"4.1.0-alpha.1"}],"component":"api-platform/graphql","cve_ids":["CVE-2025-31485"],"ecosystem":"Packagist","epss":0.00626,"exploited":false,"fixed_versions":["4.0.22","3.4.17","4.1.5"],"ghsa_id":"GHSA-428q-q3vv-3fq3","id":"tcs_01M5KETEEZ021ZYGG3AC0VD9AB","modified_at":"2025-08-29T21:36:30.705845Z","published_at":"2025-04-04T14:19:42Z","references":["https://osv.dev/vulnerability/GHSA-428q-q3vv-3fq3","https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3","https://nvd.nist.gov/vuln/detail/CVE-2025-31485","https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8","https://github.com/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a","https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31485.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31485.yaml","https://github.com/api-platform/core","https://github.com/api-platform/core/releases/tag/v3.4.17"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-428q-q3vv-3fq3","url":"https://osv.dev/vulnerability/GHSA-428q-q3vv-3fq3"}],"summary":"GraphQL grant on a property might be cached with different objects"}