GHSA-974j-wjxx-wggjMediumCVSS 6.5

Incorrect Access Control vulnerability in api-platform/core

Published
October 14, 2019
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2019-1000011 →

📋 Description

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.

🎯 Affected products2

  • composer/api-platform/core:>= 2.2.0, < 2.2.10
  • composer/api-platform/core:>= 2.3.0, < 2.3.6

🔗 References (5)