CVE-2026-54164 Overview
CVE-2026-54164 is a type confusion vulnerability [CWE-843] in API Platform Core, a framework for building hypermedia-driven REST and GraphQL APIs in PHP. The flaw affects versions prior to 4.1.30, 4.2.26, and 4.3.12. The serializer's AbstractItemNormalizer fails to validate the resource type returned when resolving relation Internationalized Resource Identifiers (IRIs). Authenticated attackers with write access can submit crafted POST, PUT, or PATCH requests to assign resources of unintended types to relation properties, corrupting downstream application invariants.
Critical Impact
Authenticated attackers can silently substitute unrelated resource types into API relation properties, corrupting integrity of persisted data and downstream business logic on legacy untyped properties.
Affected Products
- API Platform Core versions prior to 4.1.30
- API Platform Core versions prior to 4.2.26
- API Platform Core versions prior to 4.3.12
Discovery Timeline
- 2026-07-01 - CVE-2026-54164 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-54164
Vulnerability Analysis
The vulnerability resides in how API Platform Core deserializes relation IRIs into PHP objects. When a client submits a write request containing a relation reference, the serializer's AbstractItemNormalizer invokes getResourceFromIri() to hydrate the target resource. This helper calls IriConverter::getResourceFromIri() without passing an $operation argument. As a result, the is_a type guard at IriConverter.php:86 is skipped entirely, and no validation confirms the returned resource matches the declared relation class.
For legacy properties declared only with PHPDoc @var annotations, PHP performs no runtime type check during assignment. The mismatched object is silently written to the relation property. Modern PHP 8.x typed properties are protected because Symfony's PropertyAccessor throws an InvalidTypeException on assignment mismatch.
Root Cause
The root cause is a missing operation context in the IRI resolution path. Because getResourceFromIri() omits the $operation parameter, the downstream is_a guard cannot execute, and type verification is bypassed. This is a classic type confusion pattern where the framework trusts client-supplied identifiers to resolve to the expected class without cross-checking.
Attack Vector
An attacker requires authenticated access with permission to submit write requests to an API Platform endpoint exposing writable relations. The attacker replaces a legitimate relation IRI in the request payload with an IRI referencing a resource of a different declared class. The serializer resolves the substitute resource and assigns it to the relation property. Downstream code that assumes the declared type may operate on the wrong object, leading to broken invariants, incorrect authorization decisions, or data integrity violations. See the API Platform Security Advisory GHSA-9rjg-x2p2-h68h for further technical details.
Detection Methods for CVE-2026-54164
Indicators of Compromise
- Write requests (POST/PUT/PATCH) containing relation IRIs pointing to resource collections outside the endpoint's declared relation class.
- Persisted records where relation foreign keys reference identifiers from unrelated resource tables.
- Application logs recording unexpected class hydration or downstream errors that reference mismatched entity types.
Detection Strategies
- Audit API access logs for write requests where the relation IRI path segment does not match the schema-defined target resource type.
- Enable request body logging on API Platform routes and compare submitted IRIs against the OpenAPI relation contract.
- Add runtime assertions in service-layer code that verify relation object classes before persistence for legacy untyped properties.
Monitoring Recommendations
- Monitor for InvalidTypeException events from Symfony's PropertyAccessor, which indicate attempted type substitution on modern typed properties.
- Track anomalous write volume from authenticated users targeting endpoints with relation payloads.
- Correlate authentication events with downstream data integrity failures to surface exploitation attempts.
How to Mitigate CVE-2026-54164
Immediate Actions Required
- Upgrade API Platform Core to version 4.1.30, 4.2.26, or 4.3.12 depending on your release branch.
- Inventory all API resources with writable relation properties and prioritize migration of @var-only properties to typed PHP 8.x properties.
- Review recent write requests for suspicious relation IRIs that reference unexpected resource types.
Patch Information
The maintainers fixed the vulnerability in versions 4.1.30, 4.2.26, and 4.3.12 by ensuring the operation context is propagated to IriConverter::getResourceFromIri(), allowing the is_a type guard at IriConverter.php:86 to enforce the declared relation class. Patch details are available in the GitHub Security Advisory GHSA-9rjg-x2p2-h68h.
Workarounds
- Convert legacy @var-only relation properties to PHP 8.x typed properties so Symfony's PropertyAccessor enforces class checks and throws InvalidTypeException on mismatch.
- Add custom denormalization validators that verify the resolved object's class matches the relation's declared type before assignment.
- Restrict write permissions on endpoints exposing relation properties to trusted service accounts until patching is complete.
# Upgrade via Composer to a patched release
composer require api-platform/core:^4.3.12
# Or for the 4.2.x branch
composer require api-platform/core:^4.2.26
# Or for the 4.1.x branch
composer require api-platform/core:^4.1.30
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
