CVE-2026-49858

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. #[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context['cache_key'], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them. This issue has been fixed in versions 4.1.29, 4.2.26, and 4.3.12.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23

Configurations

No configuration.

History

01 Jul 2026, 20:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-01 20:17

Updated : 2026-07-02 18:41

NVD link : CVE-2026-49858

Mitre link : CVE-2026-49858

CVE.ORG link : CVE-2026-49858

JSON object : View

Products Affected

No product.

CWE

CWE-524

Use of Cache Containing Sensitive Information

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-49858", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49858", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-02T12:19:58.405684Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "api-platform", "product": "core", "versions": [{"status": "affected", "version": ">= 2.6.0, < 4.1.29"}, {"status": "affected", "version": ">= 4.2.0, < 4.2.25"}, {"status": "affected", "version": ">= 4.3.0, < 4.3.8"}]}, {"vendor": "api-platform", "product": "api-platform/hal", "versions": [{"status": "affected", "version": ">= 2.6.0, < 4.1.29"}, {"status": "affected", "version": ">= 4.2.0, < 4.2.25"}, {"status": "affected", "version": ">= 4.3.0, < 4.3.8"}]}, {"vendor": "api-platform", "product": "api-platform/json-api", "versions": [{"status": "affected", "version": ">= 2.6.0, < 4.1.29"}, {"status": "affected", "version": ">= 4.2.0, < 4.2.25"}, {"status": "affected", "version": ">= 4.3.0, < 4.3.8"}]}]}], "published": "2026-07-01T20:17:10.153", "references": [{"url": "https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-524"}, {"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. #[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\\JsonApi\\Serializer\\ItemNormalizer and ApiPlatform\\Hal\\Serializer\\ItemNormalizer are keyed on $context['cache_key'], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them. This issue has been fixed in versions 4.1.29, 4.2.26, and 4.3.12."}], "lastModified": "2026-07-02T18:41:35.990", "sourceIdentifier": "security-advisories@github.com"}