GHSA-pjhx-3c3w-9v23
Suggest an improvement- Source
- https://github.com/advisories/GHSA-pjhx-3c3w-9v23
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-pjhx-3c3w-9v23/GHSA-pjhx-3c3w-9v23.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-pjhx-3c3w-9v23
- Aliases
- Published
- 2026-07-10T14:32:01Z
- Modified
- 2026-07-10T14:46:38Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate
- Details
-
Impact
#[ApiProperty(security: ...)]is evaluated per request to decide whether a property is exposed. ThecomponentsCachearrays inApiPlatform\JsonApi\Serializer\ItemNormalizerandApiPlatform\Hal\Serializer\ItemNormalizerare keyed on$context['cache_key'], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them.This is the same vulnerability class as GHSA-428q-q3vv-3fq3 / CVE-2025-31485, which fixed only the GraphQL
ItemNormalizer. The JSON:API and HAL paths were not addressed at the time.Exploitation conditions
Exploitation requires all of the following to coincide:
- The application exposes a resource via the JSON:API and/or HAL formats.
- At least one property of that resource uses
#[ApiProperty(security: ...)]with a predicate whose result depends on the current user (or on per-request state). - A request from a user for whom the predicate evaluates to
truepopulatescomponentsCachebefore a request from a user for whom the predicate evaluates tofalse, within the lifetime of the same PHP process. - The deployment uses a long-running PHP runtime that keeps the normalizer instance alive across requests (FrankenPHP worker mode, RoadRunner, Swoole, ReactPHP, etc.). With classic
php-fpmworkers the cache only survives the duration of a single request, which makes the issue much harder to observe in practice.
Patches
- 4.1.29
- 4.2.25
- 4.3.8
All three branches receive patched releases of
api-platform/core,api-platform/json-api, andapi-platform/hal.Workarounds
Override the JSON:API and HAL
ItemNormalizerservices to gate$context['cache_key']with a resource-class security check, or avoid#[ApiProperty(security: ...)]on resources served as JSON:API or HAL until the patch is applied. Pinning the deployment to classicphp-fpmworkers also limits exposure since the cache does not survive across requests.Credits
- Tillmann Baumgart (@tillmon) — originally identified the broader cache-key gap and proposed moving
isCacheKeySafetoAbstractItemNormalizer. - Antoine Bluchet (@soyuka) — extended the gate to JSON:API and HAL normalizers.
- Database specific
{ "cwe_ids": [ "CWE-524", "CWE-639" ], "github_reviewed": true, "github_reviewed_at": "2026-07-10T14:32:01Z", "nvd_published_at": "2026-07-01T20:17:10Z", "severity": "MODERATE" }- References
Affected packages
Packagist
api-platform/core
Package
- Name
- api-platform/core
- Purl
- pkg:composer/api-platform/core
Affected versions
v2.*
v3.*
v4.*
4.*
api-platform/core
Package
- Name
- api-platform/core
- Purl
- pkg:composer/api-platform/core
api-platform/core
Package
- Name
- api-platform/core
- Purl
- pkg:composer/api-platform/core
api-platform/json-api
Package
- Name
- api-platform/json-api
- Purl
- pkg:composer/api-platform/json-api
Affected versions
v4.*
4.*
api-platform/json-api
Package
- Name
- api-platform/json-api
- Purl
- pkg:composer/api-platform/json-api
api-platform/json-api
Package
- Name
- api-platform/json-api
- Purl
- pkg:composer/api-platform/json-api
api-platform/hal
Package
- Name
- api-platform/hal
- Purl
- pkg:composer/api-platform/hal
api-platform/hal
Package
- Name
- api-platform/hal
- Purl
- pkg:composer/api-platform/hal
api-platform/hal
Package
- Name
- api-platform/hal
- Purl
- pkg:composer/api-platform/hal