VulnSocial

CVE-2026-49858Disclosure

LOWCVSS 5.9 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. #[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context['cache_key'], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them. This issue has been fixed in versions 4.1.29, 4.2.26, and 4.3.12.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-524CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-07-01)
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-04: 1Mentions · 2026-07-01: 2Patch / Workaround · 2026-06-04: 1Technical Details · 2026-06-04: 1Technical Details · 2026-07-01: 106-0407-01
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-041
Patch1
2026-07-012
Disclosure2
Full discourse3 posts
  • soyuka@s0yuka
    Patch

    🔒 API Platform CVE-2026-49858: JSON:API & HAL normalizers cached components across users on long-running runtimes (FrankenPHP, RoadRunner, Swoole). Patched in 4.1.29 / 4.2.25 / 4.3.8 — upgrade now. https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23

    Post summary

    The advisory alerts about CVE-2026-49858, explains a cross‑user caching flaw in JSON:API & HAL normalizers, and recommends upgrading to the specified patched releases.

    1501051.3K
    1.6K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-49858 API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe … https://www.cve.org/CVERecord?id=CVE-2026-49858 ----- Traducción: CVE-2026-49858 API… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-49858 for API Platform Core, indicating a missing isCacheKeySafe in certain versions, but provides no PoC, exploitation details, or patch information.

    0000031
    90 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-49858 API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe … https://www.cve.org/CVERecord?id=CVE-2026-49858

    Post summary

    The post announces CVE‑2026‑49858, noting that a missing isCacheKeySafe check in certain API Platform Core versions could lead to vulnerability, but it provides no PoC, exploit code, active usage evidence, or patch information.

    00000559
    57.7K followersView on X

Explore more

Back to dashboard