Alexandre-Daubois

**Name of the Vulnerable Software and Affected Versions** API Platform Core versions prior to 4.1.30 API Platform Core versions prior to 4.2.26 API Platform Core versions prior to 4.3.12 **Description** A type confusion issue exists in the serializer's `AbstractItemNormalizer` when resolving relation IRIs (Internationalized Resource Identifiers). The system fails to validate the resource type returned, allowing a resource of an unintended type to be silently assigned to a relation property. An attacker can exploit this by submitting write requests (POST, PUT, or PATCH) to an endpoint with writable relations, providing a relation IRI that points to a resource of a different type than the declared class. This occurs because `getResourceFromIri()` does not pass an `$operation` to `IriConverter::getResourceFromIri()`, causing the `is a` type guard in `IriConverter.php` to be skipped. For untyped relation properties, this can corrupt invariants and affect downstream logic that assumes the declared type. **Recommendations** Update to version 4.1.30 Update to version 4.2.26 Update to version 4.3.12