{"action":"Upgrade api-platform/core to 4.1.30 or later.","affected":[{"fixed":"4.1.30","introduced":"0"},{"fixed":"4.2.26","introduced":"4.2.0"},{"fixed":"4.3.12","introduced":"4.3.0"}],"component":"api-platform/core","cve_ids":["CVE-2026-54164"],"ecosystem":"Packagist","epss":0.00336,"exploited":false,"fixed_versions":["4.1.30","4.2.26","4.3.12"],"ghsa_id":"GHSA-9rjg-x2p2-h68h","id":"tcs_01M5KF094R6G09T1A3HT5B0E9R","modified_at":"2026-08-07T17:00:23.583676514Z","published_at":"2026-08-07T16:54:42Z","references":["https://osv.dev/vulnerability/GHSA-9rjg-x2p2-h68h","https://github.com/api-platform/core/security/advisories/GHSA-9rjg-x2p2-h68h","https://nvd.nist.gov/vuln/detail/CVE-2026-54164","https://github.com/api-platform/core/commit/6bcbeb2dbee53db5bb9b4b8e343bffdf7732de1e","https://github.com/api-platform/core","https://github.com/api-platform/core/releases/tag/v4.1.30","https://github.com/api-platform/core/releases/tag/v4.2.26","https://github.com/api-platform/core/releases/tag/v4.3.12"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-9rjg-x2p2-h68h","url":"https://osv.dev/vulnerability/GHSA-9rjg-x2p2-h68h"}],"summary":"API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)"}