Search
Find a vulnerability
Search criteria
2 vulnerabilities found for api-platform/hal by api-platform
CVE-2026-49858 (GCVE-0-2026-49858)
Vulnerability from nvd – Published: 2026-07-01 19:24 – Updated: 2026-07-02 12:20
VLAI
EPSS
VEX
Title
API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate
Summary
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. #[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context['cache_key'], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them. This issue has been fixed in versions 4.1.29, 4.2.26, and 4.3.12.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/api-platform/core/security/adv… | x_refsource_CONFIRM |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| api-platform | core |
Affected:
>= 2.6.0, < 4.1.29
Affected: >= 4.2.0, < 4.2.25 Affected: >= 4.3.0, < 4.3.8 |
|
| api-platform | api-platform/hal |
Affected:
>= 2.6.0, < 4.1.29
Affected: >= 4.2.0, < 4.2.25 Affected: >= 4.3.0, < 4.3.8 |
|
| api-platform | api-platform/json-api |
Affected:
>= 2.6.0, < 4.1.29
Affected: >= 4.2.0, < 4.2.25 Affected: >= 4.3.0, < 4.3.8 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49858",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-02T12:19:58.405684Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-02T12:20:09.370Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "api-platform",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.6.0, \u003c 4.1.29"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.25"
},
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.8"
}
]
},
{
"product": "api-platform/hal",
"vendor": "api-platform",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.6.0, \u003c 4.1.29"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.25"
},
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.8"
}
]
},
{
"product": "api-platform/json-api",
"vendor": "api-platform",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.6.0, \u003c 4.1.29"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.25"
},
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. #[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\\JsonApi\\Serializer\\ItemNormalizer and ApiPlatform\\Hal\\Serializer\\ItemNormalizer are keyed on $context[\u0027cache_key\u0027], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them. This issue has been fixed in versions 4.1.29, 4.2.26, and 4.3.12."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524: Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T19:24:58.170Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23"
}
],
"source": {
"advisory": "GHSA-pjhx-3c3w-9v23",
"discovery": "UNKNOWN"
},
"title": "API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49858",
"datePublished": "2026-07-01T19:24:58.170Z",
"dateReserved": "2026-06-01T22:03:19.640Z",
"dateUpdated": "2026-07-02T12:20:09.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49858 (GCVE-0-2026-49858)
Vulnerability from cvelistv5 – Published: 2026-07-01 19:24 – Updated: 2026-07-02 12:20
VLAI
EPSS
VEX
Title
API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate
Summary
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. #[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context['cache_key'], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them. This issue has been fixed in versions 4.1.29, 4.2.26, and 4.3.12.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/api-platform/core/security/adv… | x_refsource_CONFIRM |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| api-platform | core |
Affected:
>= 2.6.0, < 4.1.29
Affected: >= 4.2.0, < 4.2.25 Affected: >= 4.3.0, < 4.3.8 |
|
| api-platform | api-platform/hal |
Affected:
>= 2.6.0, < 4.1.29
Affected: >= 4.2.0, < 4.2.25 Affected: >= 4.3.0, < 4.3.8 |
|
| api-platform | api-platform/json-api |
Affected:
>= 2.6.0, < 4.1.29
Affected: >= 4.2.0, < 4.2.25 Affected: >= 4.3.0, < 4.3.8 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49858",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-02T12:19:58.405684Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-02T12:20:09.370Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "api-platform",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.6.0, \u003c 4.1.29"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.25"
},
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.8"
}
]
},
{
"product": "api-platform/hal",
"vendor": "api-platform",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.6.0, \u003c 4.1.29"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.25"
},
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.8"
}
]
},
{
"product": "api-platform/json-api",
"vendor": "api-platform",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.6.0, \u003c 4.1.29"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.25"
},
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. #[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\\JsonApi\\Serializer\\ItemNormalizer and ApiPlatform\\Hal\\Serializer\\ItemNormalizer are keyed on $context[\u0027cache_key\u0027], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them. This issue has been fixed in versions 4.1.29, 4.2.26, and 4.3.12."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524: Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T19:24:58.170Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23"
}
],
"source": {
"advisory": "GHSA-pjhx-3c3w-9v23",
"discovery": "UNKNOWN"
},
"title": "API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49858",
"datePublished": "2026-07-01T19:24:58.170Z",
"dateReserved": "2026-06-01T22:03:19.640Z",
"dateUpdated": "2026-07-02T12:20:09.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}