{"id":"CVE-2026-49858","aliases":["GHSA-pjhx-3c3w-9v23"],"title":"API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate","summary":"API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate","severity":"medium","cvss":5.9,"cwe":["CWE-524","CWE-639"],"vendor":"api-platform","product":"api-platform/core","ecosystem":"composer","affected":["api-platform/core >= 2.6.0, < 4.1.29","api-platform/core >= 4.2.0, < 4.2.25","api-platform/core >= 4.3.0, < 4.3.8","api-platform/json-api >= 4.0.0, < 4.1.29","api-platform/json-api >= 4.2.0, < 4.2.25","api-platform/json-api >= 4.3.0, < 4.3.8","api-platform/hal >= 4.0.0, < 4.1.29","api-platform/hal >= 4.2.0, < 4.2.25","api-platform/hal >= 4.3.0, < 4.3.8"],"patched":["api-platform/core 4.1.29","api-platform/core 4.2.25","api-platform/core 4.3.8","api-platform/json-api 4.1.29","api-platform/json-api 4.2.25","api-platform/json-api 4.3.8","api-platform/hal 4.1.29","api-platform/hal 4.2.25","api-platform/hal 4.3.8"],"published":"2026-07-10","updated":"2026-07-10","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-pjhx-3c3w-9v23","references":[{"url":"https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49858"},{"url":"https://github.com/advisories/GHSA-pjhx-3c3w-9v23"}],"tags":["ghsa","composer"],"epss":0.00315,"epssPercentile":0.2454,"ingestedAt":"2026-07-10T15:05:05.669Z","slug":"CVE-2026-49858","body":"## Overview\n\n### Impact\n\n`#[ApiProperty(security: ...)]` is evaluated per request to decide whether a property is exposed. The `componentsCache` arrays in `ApiPlatform\\JsonApi\\Serializer\\ItemNormalizer` and `ApiPlatform\\Hal\\Serializer\\ItemNormalizer` are keyed on `$context['cache_key']`, which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them.\n\nThis is the same vulnerability class as [GHSA-428q-q3vv-3fq3](https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3) / CVE-2025-31485, which fixed only the GraphQL `ItemNormalizer`. The JSON:API and HAL paths were not addressed at the time.\n\n### Exploitation conditions\n\nExploitation requires all of the following to coincide:\n\n- The application exposes a resource via the JSON:API and/or HAL formats.\n- At least one property of that resource uses `#[ApiProperty(security: ...)]` with a predicate whose result depends on the current user (or on per-request state).\n- A request from a user for whom the predicate evaluates to `true` populates `componentsCache` before a request from a user for whom the predicate evaluates to `false`, within the lifetime of the same PHP process.\n- The deployment uses a long-running PHP runtime that keeps the normalizer instance alive across requests (FrankenPHP worker mode, RoadRunner, Swoole, ReactPHP, etc.). With classic `php-fpm` workers the cache only survives the duration of a single request, which makes the issue much harder to observe in practice.\n\n### Patches\n\n- 4.1.29\n- 4.2.25\n- 4.3.8\n\nAll three branches receive patched releases of `api-platform/core`, `api-platform/json-api`, and `api-platform/hal`.\n\n### Workarounds\n\nOverride the JSON:API and HAL `ItemNormalizer` services to gate `$context['cache_key']` with a resource-class security check, or avoid `#[ApiProperty(security: ...)]` on resources served as JSON:API or HAL until the patch is applied. Pinning the deployment to classic `php-fpm` workers also limits exposure since the cache does not survive across requests.\n\n### Credits\n\n- Tillmann Baumgart (@tillmon) — originally identified the broader cache-key gap and proposed moving `isCacheKeySafe` to `AbstractItemNormalizer`.\n- Antoine Bluchet (@soyuka) — extended the gate to JSON:API and HAL normalizers.\n\n## Affected packages\n\n- `api-platform/core >= 2.6.0, < 4.1.29`\n- `api-platform/core >= 4.2.0, < 4.2.25`\n- `api-platform/core >= 4.3.0, < 4.3.8`\n- `api-platform/json-api >= 4.0.0, < 4.1.29`\n- `api-platform/json-api >= 4.2.0, < 4.2.25`\n- `api-platform/json-api >= 4.3.0, < 4.3.8`\n- `api-platform/hal >= 4.0.0, < 4.1.29`\n- `api-platform/hal >= 4.2.0, < 4.2.25`\n- `api-platform/hal >= 4.3.0, < 4.3.8`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `api-platform/core 4.1.29`\n- `api-platform/core 4.2.25`\n- `api-platform/core 4.3.8`\n- `api-platform/json-api 4.1.29`\n- `api-platform/json-api 4.2.25`\n- `api-platform/json-api 4.3.8`\n- `api-platform/hal 4.1.29`\n- `api-platform/hal 4.2.25`\n- `api-platform/hal 4.3.8`","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}