API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| api-platform/core(Packagist) | 2.2.0 | 2.2.10 | N/A |
| api-platform/core(Packagist) | 2.3.0 | 2.3.6 | N/A |
CVSS Metrics
