CVE-2026-49858 Details
Description
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. #[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context['cache_key'], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them. This issue has been fixed in versions 4.1.29, 4.2.26, and 4.3.12.
A cross-user attribute leak vulnerability has been identified in API Platform Core versions 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12. The issue arises from a missing 'isCacheKeySafe' gate in the JSON:API and HAL item normalizers, allowing for a leak of attributes between users with different privilege levels. The vulnerability occurs because the 'componentsCache' arrays in the item normalizers are keyed on 'cache_key', which is set unconditionally before delegating to the parent normalizer. This allows the component structure computed for one request to be reused for another request from a user with different access rights, potentially exposing properties that should have been hidden.
Users can update to API Platform Core versions 4.1.29, 4.2.25, or 4.3.8, all of which include the necessary patch. Alternatively, resources served as JSON:API or HAL can be temporarily adjusted to remove the '#[ApiProperty(security: ...)]' annotation or to override the normalizer services to include a security check before setting the cache key.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-524 | Use of Cache Containing Sensitive Information | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |