| Package | Affected versions | Patched versions |
|---|---|---|
| api-platform/core | ≥ 3.3.8, < 3.3.15 | 3.3.15 |
A security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in this clause: https://github.com/api-platform/core/pull/6444/files#diff-09e3c2cfe12a2ce65bd6c983c7ca6bfcf783f852b8d0554bb938e8ebf5e5fa65R56
Create a graphql endpoint with a security after resolver.
As this fallsback to security, the impact is there only when there's only a security after resolver and none inside security. The test at https://github.com/api-platform/core/pull/6444 is probably broken.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free