{"id":"CVE-2026-49858","aliases":["GHSA-pjhx-3c3w-9v23"],"url":"https://o3.security/vulnerability/CVE-2026-49858","summary":"API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate","details":"### Impact\n\n`#[ApiProperty(security: ...)]` is evaluated per request to decide whether a property is exposed. The `componentsCache` arrays in `ApiPlatform\\JsonApi\\Serializer\\ItemNormalizer` and `ApiPlatform\\Hal\\Serializer\\ItemNormalizer` are keyed on `$context['cache_key']`, which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them.\n\nThis is the same vulnerability class as [GHSA-428q-q3vv-3fq3](https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3) / CVE-2025-31485, which fixed only the GraphQL `ItemNormalizer`. The JSON:API and HAL paths were not addressed at the time.\n\n### Exploitation conditions\n\nExploitation requires all of the following to coincide:\n\n- The application exposes a resource via the JSON:API and/or HAL formats.\n- At least one property of that resource uses `#[ApiProperty(security: ...)]` with a predicate whose result depends on the current user (or on per-request state).\n- A request from a user for whom the predicate evaluates to `true` populates `componentsCache` before a request from a user for whom the predicate evaluates to `false`, within the lifetime of the same PHP process.\n- The deployment uses a long-running PHP runtime that keeps the normalizer instance alive across requests (FrankenPHP worker mode, RoadRunner, Swoole, ReactPHP, etc.). With classic `php-fpm` workers the cache only survives the duration of a single request, which makes the issue much harder to observe in practice.\n\n### Patches\n\n- 4.1.29\n- 4.2.25\n- 4.3.8\n\nAll three branches receive patched releases of `api-platform/core`, `api-platform/json-api`, and `api-platform/hal`.\n\n### Workarounds\n\nOverride the JSON:API and HAL `ItemNormalizer` services to gate `$context['cache_key']` with a resource-class security check, or avoid `#[ApiProperty(security: ...)]` on resources served as JSON:API or HAL until the patch is applied. Pinning the deployment to classic `php-fpm` workers also limits exposure since the cache does not survive across requests.\n\n### Credits\n\n- Tillmann Baumgart (@tillmon) — originally identified the broader cache-key gap and proposed moving `isCacheKeySafe` to `AbstractItemNormalizer`.\n- Antoine Bluchet (@soyuka) — extended the gate to JSON:API and HAL normalizers.","published":"2026-07-01T19:24:58.170Z","modified":"2026-10-21T02:58:23.930065905Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00315,"percentile":0.24448,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"api-platform/core","fixedVersion":"4.1.29"},{"ecosystem":"Packagist","name":"api-platform/core","fixedVersion":"4.2.25"},{"ecosystem":"Packagist","name":"api-platform/core","fixedVersion":"4.3.8"},{"ecosystem":"Packagist","name":"api-platform/json-api","fixedVersion":"4.1.29"},{"ecosystem":"Packagist","name":"api-platform/json-api","fixedVersion":"4.2.25"},{"ecosystem":"Packagist","name":"api-platform/json-api","fixedVersion":"4.3.8"},{"ecosystem":"Packagist","name":"api-platform/hal","fixedVersion":"4.1.29"},{"ecosystem":"Packagist","name":"api-platform/hal","fixedVersion":"4.2.25"},{"ecosystem":"Packagist","name":"api-platform/hal","fixedVersion":"4.3.8"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49858.json"},{"type":"ADVISORY","url":"https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49858"},{"type":"PACKAGE","url":"https://github.com/api-platform/core"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:23.930065905Z"}}