Medium, CVSS 5.9PackagistPublished
API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate
CVE-2026-49858 · GHSA-pjhx-3c3w-9v23
- Affected
- Packagist api-platform/hal >= 4.0.0, < 4.1.29; >= 4.2.0, < 4.2.25; >= 4.3.0, < 4.3.8
- Fixed in
- 4.2.254.3.84.1.29· Vendor fix available
- Issue
- Impact #[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context['cachekey'], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them. This is the same vulnerability class as GHSA-428q-q3vv-3fq3 / CVE-2025-31485, which fixed only the GraphQL ItemNormalizer. The JSON:API and HAL paths were not addressed at the time. Exploitation conditions Exploitation requires all of the following to coincide: - The application exposes a resource via the JSON:API and/or HAL…
Recommended action: Upgrade to 4.3.8, 4.2.25 or 4.1.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.