Executive brief
API Platform, a framework for building web APIs, contains a flaw where sensitive data fields might be leaked to unauthorized users. This occurs because the system incorrectly reuses cached data structures between different users' requests when using JSON:API or HAL formats. In certain high-performance server environments, a lower-privileged user could see the structure of data that should have been hidden by security rules.
Technical details
The vulnerability exists in the ItemNormalizer for JSON:API and HAL formats within API Platform Core. The `componentsCache` arrays are keyed on `$context['cache_key']` without verifying if the cache key is safe for the current security context (missing `isCacheKeySafe` gate). Consequently, if a high-privileged user triggers a resource normalization, the resulting structure—including restricted attributes—is cached and may be served to a subsequent low-privileged user. This is primarily exploitable in long-running PHP runtimes (e.g., FrankenPHP, RoadRunner, Swoole) where the normalizer instance persists across requests. Patches are available in versions 4.1.29, 4.2.25, and 4.3.8.
Affected products
- api-platform core >= 2.6.0, < 4.1.29; >= 4.2.0, < 4.2.25; >= 4.3.0, < 4.3.8
- api-platform json-api >= 4.0.0, < 4.1.29; >= 4.2.0, < 4.2.25; >= 4.3.0, < 4.3.8
- api-platform hal >= 4.0.0, < 4.1.29; >= 4.2.0, < 4.2.25; >= 4.3.0, < 4.3.8
Timeline
- 2026-06-04: disclosed
- 2026-07-01: advisory: NVD publication date
- 2026-07-10: advisory: GitHub Advisory published