{"action":"Upgrade api-platform/core to 3.3.15 or later.","affected":[{"fixed":"3.3.15","introduced":"3.3.8"}],"component":"api-platform/core","cve_ids":["CVE-2025-23204"],"ecosystem":"Packagist","epss":0.00301,"exploited":false,"fixed_versions":["3.3.15"],"ghsa_id":"GHSA-7mxx-3cgm-xxv3","id":"tcs_01M5KEY8KKBESF64485F0MX7K8","modified_at":"2025-03-24T18:56:56.970231Z","published_at":"2025-03-24T16:31:08Z","references":["https://osv.dev/vulnerability/GHSA-7mxx-3cgm-xxv3","https://github.com/api-platform/core/security/advisories/GHSA-7mxx-3cgm-xxv3","https://nvd.nist.gov/vuln/detail/CVE-2025-23204","https://github.com/api-platform/core/pull/6444","https://github.com/api-platform/core/pull/6444/files#diff-09e3c2cfe12a2ce65bd6c983c7ca6bfcf783f852b8d0554bb938e8ebf5e5fa65R56","https://github.com/api-platform/core/commit/dc4fc84ba93e22b4f44a37e90a93c6d079c1c620","https://github.com/api-platform/core","https://github.com/soyuka/core/blob/7e2e8f9ff322ac5f6eb5f65baf432bffdca0fd51/src/Symfony/Security/State/AccessCheckerProvider.php#L49-L57"],"severity":{"label":"medium","score":4.4},"sources":[{"source":"osv","source_id":"GHSA-7mxx-3cgm-xxv3","url":"https://osv.dev/vulnerability/GHSA-7mxx-3cgm-xxv3"}],"summary":"API Platform Core does not call GraphQl securityAfterResolver"}