CVE-2026-49858

Name of the Vulnerable Software and Affected Versions API Platform Core versions 2.6.0 through 4.1.28 API Platform Core versions 4.2.0 through 4.2.25 API Platform Core versions 4.3.0 through 4.3.11

Description A missing isCacheKeySafe gate in the JSON:API and HAL item normalizers leads to a cross-user attribute leak. The #[ApiProperty(security: ...)] attribute is evaluated per request to determine property exposure. However, the componentsCache arrays in ApiPlatformJsonApiSerializerItemNormalizer and ApiPlatformHalSerializerItemNormalizer are keyed on $context['cache key'], which is set unconditionally. Consequently, the component structure including attributes, relationships, and links computed for one request may be reused for a subsequent request by a user with different access privileges. This allows a user with lower privileges to view property structures that should have been hidden by the security predicate. This issue specifically affects long-running runtimes such as FrankenPHP, RoadRunner, and Swoole.

Recommendations Update to version 4.1.29 or newer. Update to version 4.2.26 or newer. Update to version 4.3.12 or newer.