API Platform Core: Missing IRI type check enables resource type confusion
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions prior to 4.1.30, 4.2.26 and 4.3.12, the serializer's AbstractItemNormalizer does not validate the resource type returned when resolving relation IRIs, allowing type confusion where a resource of an unintended type can be silently assigned to a relation property. An attacker who can submit write requests (POST/PUT/PATCH) to an API Platform endpoint with writable relations can supply a relation IRI pointing to a resource of a different type than the relation's declared class. Because getResourceFromIri() does not pass an $operation to IriConverter::getResourceFromIri(), the is_a type guard at IriConverter.php:86 is skipped. For untyped relation properties (legacy @var-only style), the wrong-typed object is silently assigned, corrupting invariants and potentially feeding downstream logic that assumes the declared type (CWE-843). For typed properties (modern PHP 8.x), the substitution is blocked by Symfony's PropertyAccessor with an InvalidTypeException. This issue has been fixed in versions 4.1.30, 4.2.26 and 4.3.12.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| api-platform | core | before 4.1.30; 4.2.0 to before 4.2.26; 4.3.0 to before 4.3.12 | 4.1.30, 4.2.26, 4.3.12 | Patch available | CNA |
| — | api-platform/core (Packagist) | before 4.1.30 | 4.1.30 | Patch available | GHSA-9rjg-x2p2-h68h |
| — | api-platform/core (Packagist) | 4.2.0 to before 4.2.26 | 4.2.26 | Patch available | GHSA-9rjg-x2p2-h68h |
| — | api-platform/core (Packagist) | 4.3.0 to before 4.3.12 | 4.3.12 | Patch available | GHSA-9rjg-x2p2-h68h |
- core Vendorapi-platform Affected before 4.1.30; 4.2.0 to before 4.2.26; 4.3.0 to before 4.3.12 Fixed in 4.1.30, 4.2.26, 4.3.12 Patch available CNA
- api-platform/core (Packagist) Vendor— Affected before 4.1.30 Fixed in 4.1.30 Patch available GHSA-9rjg-x2p2-h68h
- api-platform/core (Packagist) Vendor— Affected 4.2.0 to before 4.2.26 Fixed in 4.2.26 Patch available GHSA-9rjg-x2p2-h68h
- api-platform/core (Packagist) Vendor— Affected 4.3.0 to before 4.3.12 Fixed in 4.3.12 Patch available GHSA-9rjg-x2p2-h68h
Remediation
- Fix · CNA core (api-platform) Fixed in 4.1.30, 4.2.26, 4.3.12
- Fix · GHSA-9rjg-x2p2-h68h api-platform/core (Packagist) Fixed in 4.1.30 Advisory →
- Fix · GHSA-9rjg-x2p2-h68h api-platform/core (Packagist) Fixed in 4.2.26 Advisory →
- Fix · GHSA-9rjg-x2p2-h68h api-platform/core (Packagist) Fixed in 4.3.12 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54164
- 2026-10-03 Alias added: GHSA-9rjg-x2p2-h68h
References
Other 6
- https://github.com/api-platform/core/security/advisories/GHSA-9rjg-x2p2-h68h
- https://github.com/api-platform/core/commit/6bcbeb2dbee53db5bb9b4b8e343bffdf7732de1e
- https://github.com/api-platform/core
- https://github.com/api-platform/core/releases/tag/v4.1.30
- https://github.com/api-platform/core/releases/tag/v4.2.26
- https://github.com/api-platform/core/releases/tag/v4.3.12
More api-platform vulnerabilities
- TI-2025-22662 GraphQL query operations security can be bypassed CVSS 3.1HIGH 7.5
- TI-2023-25779 API Platform Core can leak exceptions message that may contain sensitive information CVSS 3.1MEDIUM 5.3
- TI-2025-16989 GraphQl securityAfterResolver not called CVSS 3.1MEDIUM 4.4
- TI-2025-22666 GraphQL grant on a property might be cached with different objects CVSS 3.1HIGH 7.5
- TI-2023-10878 Secured properties in API Platform Core may be accessible within collections CVSS 3.1HIGH 7.7
- TI-2019-15828 API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control… CVSS 3.0MEDIUM 6.5
Sources
- CVE-2026-54164 · CVE Program
- CVE-2026-54164 · NVD
- FIRST EPSS
- GHSA-9rjg-x2p2-h68h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences