API Platform Core CVE-2026-49858

Exploitation requires three concurrent conditions: the target application must use #[ApiProperty(security: ...)] annotations to restrict property visibility on a per-user basis; the attacker must hold at least a lower-privileged authenticated account capable of issuing requests to the affected JSON:API or HAL endpoint; and a higher-privileged user's request must have populated the componentsCache for the same cache_key within the active cache window. Applications that do not configure per-user property security gates via #[ApiProperty(security: ...)] are entirely unaffected. Exploitation is further bounded by the fact that only property structure (attribute and relationship names, link shapes) is disclosed - not property values - limiting the sensitivity of the leak to the semantic meaning of the hidden field names themselves. The CVSS AC:H reflects the cache timing dependency, though in high-traffic deployments this window is frequently available.

The NVD-assigned CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects network-reachable exploitation but acknowledges high attack complexity due to the cache timing dependency. No EPSS score is available in the provided intelligence, so exploitation probability cannot be quantified precisely. There is no CISA KEV listing and no published POC, indicating no confirmed or widespread active exploitation. The C:H rating merits scrutiny: the leak exposes property structure - attribute names, relationship keys, and link shapes - rather than actual property values, which may constitute a lower effective confidentiality impact in practice than C:H implies; however, if the hidden property names themselves carry sensitive semantic meaning (e.g., the existence of an admin_override field), the structural disclosure can be operationally significant. The AC:H constraint is genuine: exploitation requires a race-condition-like scenario where a higher-privileged user's request populates the cache and a lower-privileged user's request hits the same cache_key entry before expiry. In high-traffic multi-tenant deployments this window is routinely available, making the effective complexity lower than AC:H suggests in those environments. The PR:N assignment may overstate accessibility since the attacker must hold at least a lower-privileged account to issue the API request and observe the leaked structure. Overall this is a genuine medium-severity information disclosure that should be patched in any application using per-user property security gates, but it is not an emergency given the absence of known exploitation.

A lower-privileged user sends a JSON:API or HAL GET request to an endpoint shortly after a higher-privileged user accessed the same resource, causing their request to be served from the componentsCache entry keyed on the shared cache_key. The lower-privileged user's response includes the full attribute, relationship, and link structure computed for the higher-privileged user's security context, revealing the names of properties that the #[ApiProperty(security: ...)] predicate would have hidden. No public exploit code exists; successful exploitation depends on cache timing alignment, which is a realistic condition in high-traffic multi-tenant APIs.