tocsin

CVE-2026-49858

3 advisories.

Packagist/api-platform/core CVE-2026-49858: medium 5.9, EPSS 0.32%

API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

Action: Upgrade api-platform/core to 4.1.29 or later.

composer require api-platform/core:4.1.29
composer require api-platform/core:4.2.25
composer require api-platform/core:4.3.8

Affected

introducedfixedlast affected
2.6.04.1.29-
4.2.04.2.25-
4.3.04.3.8-

Fixed versions

4.1.294.2.254.3.8

Sources

CVE-2026-49858 · published · modified · JSON

Packagist/api-platform/json-api CVE-2026-49858: medium 5.9, EPSS 0.32%

API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

Action: Upgrade api-platform/json-api to 4.1.29 or later.

composer require api-platform/json-api:4.1.29
composer require api-platform/json-api:4.2.25
composer require api-platform/json-api:4.3.8

Affected

introducedfixedlast affected
4.0.04.1.29-
4.2.04.2.25-
4.3.04.3.8-

Fixed versions

4.1.294.2.254.3.8

Sources

CVE-2026-49858 · published · modified · JSON

Packagist/api-platform/hal CVE-2026-49858: medium 5.9, EPSS 0.32%

API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

Action: Upgrade api-platform/hal to 4.1.29 or later.

composer require api-platform/hal:4.1.29
composer require api-platform/hal:4.2.25
composer require api-platform/hal:4.3.8

Affected

introducedfixedlast affected
4.0.04.1.29-
4.2.04.2.25-
4.3.04.3.8-

Fixed versions

4.1.294.2.254.3.8

Sources

CVE-2026-49858 · published · modified · JSON