Read the docs
TI-2026-36762 Aliases CVE-2026-49858GHSA-pjhx-3c3w-9v23

API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

Priority LOW 26CWE-524Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. #[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context['cache_key'], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them. This issue has been fixed in versions 4.1.29, 4.2.26, and 4.3.12.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00315 24th percentileScored 2026-11-07
Fix Fixed core (api-platform): 4.1.29, 4.2.25, 4.3.8api-platform/hal (api-platform): 4.1.29, 4.2.25, 4.3.8+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
api-platformcore2.6.0 to before 4.1.29; 4.2.0 to before 4.2.25; 4.3.0 to before 4.3.84.1.29, 4.2.25, 4.3.8Patch availableCNA
api-platformapi-platform/hal2.6.0 to before 4.1.29; 4.2.0 to before 4.2.25; 4.3.0 to before 4.3.84.1.29, 4.2.25, 4.3.8Patch availableCNA
api-platformapi-platform/json-api2.6.0 to before 4.1.29; 4.2.0 to before 4.2.25; 4.3.0 to before 4.3.84.1.29, 4.2.25, 4.3.8Patch availableCNA
—api-platform/core (Packagist)2.6.0 to before 4.1.294.1.29Patch availableGHSA-pjhx-3c3w-9v23
—api-platform/core (Packagist)4.2.0 to before 4.2.254.2.25Patch availableGHSA-pjhx-3c3w-9v23
—api-platform/core (Packagist)4.3.0 to before 4.3.84.3.8Patch availableGHSA-pjhx-3c3w-9v23
—api-platform/json-api (Packagist)4.0.0 to before 4.1.294.1.29Patch availableGHSA-pjhx-3c3w-9v23
—api-platform/json-api (Packagist)4.2.0 to before 4.2.254.2.25Patch availableGHSA-pjhx-3c3w-9v23
—api-platform/json-api (Packagist)4.3.0 to before 4.3.84.3.8Patch availableGHSA-pjhx-3c3w-9v23
—api-platform/hal (Packagist)4.0.0 to before 4.1.294.1.29Patch availableGHSA-pjhx-3c3w-9v23
—api-platform/hal (Packagist)4.2.0 to before 4.2.254.2.25Patch availableGHSA-pjhx-3c3w-9v23
—api-platform/hal (Packagist)4.3.0 to before 4.3.84.3.8Patch availableGHSA-pjhx-3c3w-9v23
  • core Vendorapi-platform Affected 2.6.0 to before 4.1.29; 4.2.0 to before 4.2.25; 4.3.0 to before 4.3.8 Fixed in 4.1.29, 4.2.25, 4.3.8 Patch available CNA
  • api-platform/hal Vendorapi-platform Affected 2.6.0 to before 4.1.29; 4.2.0 to before 4.2.25; 4.3.0 to before 4.3.8 Fixed in 4.1.29, 4.2.25, 4.3.8 Patch available CNA
  • api-platform/json-api Vendorapi-platform Affected 2.6.0 to before 4.1.29; 4.2.0 to before 4.2.25; 4.3.0 to before 4.3.8 Fixed in 4.1.29, 4.2.25, 4.3.8 Patch available CNA
  • api-platform/core (Packagist) Vendor— Affected 2.6.0 to before 4.1.29 Fixed in 4.1.29 Patch available GHSA-pjhx-3c3w-9v23
  • api-platform/core (Packagist) Vendor— Affected 4.2.0 to before 4.2.25 Fixed in 4.2.25 Patch available GHSA-pjhx-3c3w-9v23
  • api-platform/core (Packagist) Vendor— Affected 4.3.0 to before 4.3.8 Fixed in 4.3.8 Patch available GHSA-pjhx-3c3w-9v23
  • api-platform/json-api (Packagist) Vendor— Affected 4.0.0 to before 4.1.29 Fixed in 4.1.29 Patch available GHSA-pjhx-3c3w-9v23
  • api-platform/json-api (Packagist) Vendor— Affected 4.2.0 to before 4.2.25 Fixed in 4.2.25 Patch available GHSA-pjhx-3c3w-9v23
  • api-platform/json-api (Packagist) Vendor— Affected 4.3.0 to before 4.3.8 Fixed in 4.3.8 Patch available GHSA-pjhx-3c3w-9v23
  • api-platform/hal (Packagist) Vendor— Affected 4.0.0 to before 4.1.29 Fixed in 4.1.29 Patch available GHSA-pjhx-3c3w-9v23
  • api-platform/hal (Packagist) Vendor— Affected 4.2.0 to before 4.2.25 Fixed in 4.2.25 Patch available GHSA-pjhx-3c3w-9v23
  • api-platform/hal (Packagist) Vendor— Affected 4.3.0 to before 4.3.8 Fixed in 4.3.8 Patch available GHSA-pjhx-3c3w-9v23

Remediation

  • Fix · CNA core (api-platform) Fixed in 4.1.29, 4.2.25, 4.3.8
  • Fix · CNA api-platform/hal (api-platform) Fixed in 4.1.29, 4.2.25, 4.3.8
  • Fix · CNA api-platform/json-api (api-platform) Fixed in 4.1.29, 4.2.25, 4.3.8
  • Fix · GHSA-pjhx-3c3w-9v23 api-platform/core (Packagist) Fixed in 4.1.29 Advisory →
  • Fix · GHSA-pjhx-3c3w-9v23 api-platform/core (Packagist) Fixed in 4.2.25 Advisory →
  • Fix · GHSA-pjhx-3c3w-9v23 api-platform/core (Packagist) Fixed in 4.3.8 Advisory →
  • Fix · GHSA-pjhx-3c3w-9v23 api-platform/json-api (Packagist) Fixed in 4.1.29 Advisory →
  • Fix · GHSA-pjhx-3c3w-9v23 api-platform/json-api (Packagist) Fixed in 4.2.25 Advisory →
  • Fix · GHSA-pjhx-3c3w-9v23 api-platform/json-api (Packagist) Fixed in 4.3.8 Advisory →
  • Fix · GHSA-pjhx-3c3w-9v23 api-platform/hal (Packagist) Fixed in 4.1.29 Advisory →
  • Fix · GHSA-pjhx-3c3w-9v23 api-platform/hal (Packagist) Fixed in 4.2.25 Advisory →
  • Fix · GHSA-pjhx-3c3w-9v23 api-platform/hal (Packagist) Fixed in 4.3.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49858
  2. 2026-10-03 Alias added: GHSA-pjhx-3c3w-9v23

References

Advisory 1

Other 2

  • TI-2025-22662 GraphQL query operations security can be bypassed CVSS 3.1HIGH 7.5
  • TI-2023-25779 API Platform Core can leak exceptions message that may contain sensitive information CVSS 3.1MEDIUM 5.3
  • TI-2026-39072 API Platform Core: Missing IRI type check enables resource type confusion CVSS 3.1MEDIUM 6.5
  • TI-2025-16989 GraphQl securityAfterResolver not called CVSS 3.1MEDIUM 4.4
  • TI-2025-22666 GraphQL grant on a property might be cached with different objects CVSS 3.1HIGH 7.5
  • TI-2023-10878 Secured properties in API Platform Core may be accessible within collections CVSS 3.1HIGH 7.7
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences