EUVD-2026-41129
GHSA-pjhx-3c3w-9v23
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attacker must hold a lower-privileged account (PR:L) to issue API requests; cache timing dependency justifies AC:H; no integrity or availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. #[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context['cache_key'], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them. This issue has been fixed in versions 4.1.29, 4.2.26, and 4.3.12.
AnalysisAI
Cross-user attribute structure leakage in API Platform Core's JSON:API and HAL serializers exposes the schema layout of security-gated properties to lower-privileged users through improper cache reuse. Versions from 2.6.0 up to 4.1.29, 4.2.26, and 4.3.12 are affected across the core, hal, and json-api packages. The component structure computed for a higher-privileged user's request can be served from cache to a subsequent lower-privileged user's request, bypassing the per-request evaluation of #[ApiProperty(security: ...)] predicates. No public exploit identified at time of analysis; vendor-released patches are available.
Technical ContextAI
API Platform Core (cpe:2.3:a:api-platform:core) is a PHP framework for building hypermedia-driven REST and GraphQL APIs on top of Symfony. The root cause is CWE-524 (Use of Cache Containing Sensitive Information): both ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer maintain an internal componentsCache array keyed on $context['cache_key']. This key is set unconditionally before delegating to the parent normalizer, without first consulting the isCacheKeySafe gate that determines whether a given cache key is safe to reuse across security contexts. The #[ApiProperty(security: ...)] annotation is designed to be evaluated per-request to decide whether a property (attribute, relationship, or link) is exposed in the serialized output. Because the cache bypasses this per-request gate, the structural decisions made for one user's security context are frozen in cache and replayed for a subsequent user who may have a different permission set. The affected CPEs span cpe:2.3:a:api-platform:api-platform/hal and cpe:2.3:a:api-platform:api-platform/json-api as well as the core package.
RemediationAI
Upgrade to API Platform Core 4.1.29, 4.2.26, or 4.3.12 - whichever matches the installed minor branch - as these releases introduce the missing isCacheKeySafe check in both the JSON:API and HAL item normalizers, preventing cross-user reuse of the componentsCache. Full patch details are in the vendor advisory at https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23. If an immediate upgrade is not feasible, a targeted compensating control is to customize the API Platform serialization context builder to incorporate a user-specific token (such as a hashed user ID or role fingerprint) into the cache_key context parameter, ensuring that cache entries are never shared across users with differing security contexts. The trade-off of this workaround is increased per-request serialization overhead and potential cache size growth proportional to the number of distinct user security profiles. Applications that do not use #[ApiProperty(security: ...)] for per-user property gating are not susceptible to this specific issue and need not apply the workaround as a priority.
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via t
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via
An issue was discovered in Form Tools through 3.0.20. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Remote code execution in REDAXO CMS versions 5.18.2 through 5.21.0 is reachable by authenticated backend users with medi
Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0. Rated medium se
An issue was discovered in Form Tools through 3.0.20. Rated medium severity (CVSS 6.1), this vulnerability is remotely e
An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,
An issue was discovered in Form Tools through 3.0.20. Rated medium severity (CVSS 5.4), this vulnerability is remotely e
OS command injection in Liman server management software (limanmys/core) before version 2.2.2 - 1103 lets an authenticat
Unsandboxed Twig template rendering in Bolt CMS allows any user holding an editor-level CMS role to inject arbitrary OS
Authentication bypass in UltraDAG Core blockchain allows remote unauthenticated attackers to drain all pocket-derived su
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today