CVE-2026-49858: API Platform Core Information Disclosure

CVE-2026-49858 Overview

CVE-2026-49858 affects API Platform Core, a framework for building hypermedia-driven REST and GraphQL APIs. The vulnerability exists in versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12. A missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. The component structure computed for one request can be reused for a subsequent request whose user has a different set of accessible properties. Lower-privileged users may see attribute and relationship structures that the security predicate should have hidden.

Critical Impact
Cross-user information disclosure allowing unauthorized visibility into API property structures protected by per-request security predicates [CWE-524].

Affected Products

API Platform Core versions 2.6.0 through 4.1.28
API Platform Core versions 4.2.0 through 4.2.25
API Platform Core versions 4.3.0 through 4.3.11

Discovery Timeline

2026-07-01 - CVE-2026-49858 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-49858

Vulnerability Analysis

The vulnerability resides in the serialization layer of API Platform Core. The #[ApiProperty(security: ...)] attribute is evaluated per request to determine whether a property is exposed to the current user. This per-request evaluation is defeated by an unsafe caching mechanism that ignores user context. The result is an information disclosure flaw where the response structure leaks details of properties the security predicate would otherwise hide.

Root Cause

The componentsCache arrays inside ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context['cache_key']. This key is set unconditionally before delegating to the parent normalizer. The framework does not invoke an isCacheKeySafe check to verify that the cache key accounts for security-sensitive attributes. Cached component structures from a privileged request are then served to subsequent requests from users with different authorization scopes.

Attack Vector

An unauthenticated or low-privileged attacker sends requests to an affected JSON:API or HAL endpoint after a higher-privileged user has generated a cached component structure. The attacker's response includes attributes, relationships, or links that should have been filtered out by the per-property security predicate. Exploitation requires specific request timing and shared cache state, which raises attack complexity. Successful exploitation does not modify data but reveals the structure and existence of privileged properties.

No public proof-of-concept code is available. Refer to the GitHub Security Advisory for additional technical detail.

Detection Methods for CVE-2026-49858

Indicators of Compromise

API responses containing attribute names, relationship references, or HAL _links entries that should be restricted by #[ApiProperty(security: ...)] predicates for the requesting user role.
Response payload structures that vary across identical requests from the same low-privileged user, indicating cache-driven leakage.

Detection Strategies

Review application logs for JSON:API and HAL endpoint responses and compare serialized property sets against the expected authorization scope for each user role.
Deploy differential response testing that issues identical requests as different user roles and identifies overlapping structural fields.
Audit usage of ItemNormalizer subclasses and any custom overrides that manipulate $context['cache_key'].

Monitoring Recommendations

Monitor API gateway telemetry for unusual response shape variance across sessions on the same endpoint.
Track deployment versions of api-platform/core across services and alert on any instance below the fixed releases.
Enable serializer-level logging in non-production to capture cache key generation and component structure reuse.

How to Mitigate CVE-2026-49858

Immediate Actions Required

Upgrade api-platform/core to version 4.1.29, 4.2.26, or 4.3.12 depending on your current branch.
Inventory all services using API Platform Core between versions 2.6.0 and the fixed releases.
Review all #[ApiProperty(security: ...)] usages to confirm the predicates depend on values now included in the safe cache key evaluation.

Patch Information

The maintainers fixed this issue in API Platform Core versions 4.1.29, 4.2.26, and 4.3.12. The fix introduces the isCacheKeySafe gate in the JSON:API and HAL item normalizers so that cached component structures are only reused when the cache key reflects security-relevant context. See the GitHub Security Advisory GHSA-pjhx-3c3w-9v23 for the upstream advisory.

Workarounds

Disable the JSON:API and HAL formats on affected endpoints until upgrade is possible.
Override the affected ItemNormalizer classes to unset $context['cache_key'] when properties use security predicates.
Restrict access to endpoints that expose properties gated by #[ApiProperty(security: ...)] until patched versions are deployed.

bash

# Upgrade via Composer to a fixed release
composer require api-platform/core:^4.3.12
# Or for the 4.2 branch
composer require api-platform/core:^4.2.26
# Or for the 4.1 branch
composer require api-platform/core:^4.1.29