Detections
Analytics

SCA: security update for api-platform/core, api-platform/hal, api-platform/json-api (GHSA-pjhx-3c3w-9v23)

medium Tenable Self-Hosted Container Security Plugin ID 444619

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0
 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item
 normalizers causes a cross-user attribute leak. #[ApiProperty(security: ...)] is evaluated per request to
 decide whether a property is exposed. The componentsCache arrays in
 ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on
 $context['cache_key'], which is set unconditionally before delegating to the parent normalizer. The
 component structure (attributes, relationships, links) computed for one request can therefore be reused
 for a subsequent request whose user has a different set of accessible properties. A user with lower
 privileges may end up seeing the structure of properties that the security predicate would otherwise have
 hidden for them. This issue has been fixed in versions 4.1.29, 4.2.26, and 4.3.12. (CVE-2026-49858)

Solution

Update the api-platform/core library and its related packages to version 4.1.29 or later.

See Also

https://github.com/advisories/GHSA-pjhx-3c3w-9v23

Plugin Details

Severity: Medium

ID: 444619

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 7/10/2026

Updated: 7/10/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.72

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-49858

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/10/2026

Vulnerability Publication Date: 7/1/2026

Reference Information

CVE: CVE-2026-49858