Tillmon

**Name of the Vulnerable Software and Affected Versions** API Platform Core versions 2.6.0 through 4.1.28 API Platform Core versions 4.2.0 through 4.2.25 API Platform Core versions 4.3.0 through 4.3.11 **Description** A missing isCacheKeySafe gate in the JSON:API and HAL item normalizers leads to a cross-user attribute leak. The `#[ApiProperty(security: ...)]` attribute is evaluated per request to determine property exposure. However, the `componentsCache` arrays in `ApiPlatformJsonApiSerializerItemNormalizer` and `ApiPlatformHalSerializerItemNormalizer` are keyed on `$context['cache key']`, which is set unconditionally. Consequently, the component structure including attributes, relationships, and links computed for one request may be reused for a subsequent request by a user with different access privileges. This allows a user with lower privileges to view property structures that should have been hidden by the security predicate. This issue specifically affects long-running runtimes such as FrankenPHP, RoadRunner, and Swoole. **Recommendations** Update to version 4.1.29 or newer. Update to version 4.2.26 or newer. Update to version 4.3.12 or newer.