api-platform/core Security Advisories | GitStock

medium2026-08-07

API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)

GHSA-9rjg-x2p2-h68h · CVE-2026-54164

medium2026-07-10

API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

GHSA-pjhx-3c3w-9v23 · CVE-2026-49858

high2025-04-04

GraphQL grant on a property might be cached with different objects

GHSA-428q-q3vv-3fq3 · CVE-2025-31485

high2025-04-04

GraphQL query operations security can be bypassed

GHSA-cg3c-245w-728m · CVE-2025-31481

medium2025-04-03

API Platform Core can leak exceptions message that may contain sensitive information

GHSA-rfw5-cqjj-7v9r · CVE-2023-47639

medium2025-03-24

API Platform Core does not call GraphQl securityAfterResolver

GHSA-7mxx-3cgm-xxv3 · CVE-2025-23204

high2023-02-28

api-platform/core's secured properties may be accessible within collections

GHSA-vr2x-7687-h6qv · CVE-2023-25575