Skip to content
OpenAdvisories

Vendor

api-platform

7 known vulnerabilities.

Products

core 7 api-platform/hal 1 api-platform/json-api 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-49858

    API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

    API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. #[ApiProper…

    api-platform core api-platform/hal api-platform/json-api Packagist
  • Medium 6.5
    CVE-2026-54164

    API Platform Core: Missing IRI type check enables resource type confusion

    API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions prior to 4.1.30, 4.2.26 and 4.3.12, the serializer's AbstractItemNormalizer does not validate the resource type returned when resolving relation IRIs, allowing type c…

    api-platform core api-platform/core Packagist
  • Medium 5.3
    CVE-2023-47639

    API Platform Core can leak exceptions message that may contain sensitive information

    API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HTTP exceptions, are visible in the JSON error response. This vulnerability is fixed in 3.2.5.

    api-platform core api-platform/core Packagist
  • Medium 4.4
    CVE-2025-23204

    GraphQl securityAfterResolver not called

    API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As this falls back to `sec…

    api-platform core api-platform/core Packagist