Api-platform Core vulnerabilities

• api-platform core, api-platform/hal, api-platform/json-api +2 more API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate CVE-2026-49858 Fix available 5.9 MediumJuly 1, 2026
• api-platform core API Platform Core: Missing IRI type check enables resource type confusion CVE-2026-54164 Fix available 6.5 MediumJuly 1, 2026
• api-platform core GraphQL grant on a property might be cached with different objects CVE-2025-31485 Fix available 7.5 HighApril 3, 2025
• api-platform core GraphQL query operations security can be bypassed CVE-2025-31481 Fix available 7.5 HighApril 3, 2025
• api-platform core API Platform Core can leak exceptions message that may contain sensitive information CVE-2023-47639 Fix available 5.3 MediumApril 3, 2025
• api-platform core GraphQl securityAfterResolver not called CVE-2025-23204 Fix available 4.4 MediumMarch 24, 2025
• api-platform core Secured properties in API Platform Core may be accessible within collections CVE-2023-25575 Fix available 7.7 HighFebruary 28, 2023
• api-platform core Incorrect Access Control vulnerability in api-platform/core CVE-2019-1000011 Fix available 6.5 MediumFebruary 4, 2019