PT-2026-49086 · Unknown · Api Platform Core
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
API Platform Core versions prior to 4.1.30
API Platform Core versions prior to 4.2.26
API Platform Core versions prior to 4.3.12
Description
A type confusion issue exists in the serializer's
AbstractItemNormalizer when resolving relation IRIs (Internationalized Resource Identifiers). The system fails to validate the resource type returned, allowing a resource of an unintended type to be silently assigned to a relation property. An attacker can exploit this by submitting write requests (POST, PUT, or PATCH) to an endpoint with writable relations, providing a relation IRI that points to a resource of a different type than the declared class. This occurs because getResourceFromIri() does not pass an $operation to IriConverter::getResourceFromIri(), causing the is a type guard in IriConverter.php to be skipped. For untyped relation properties, this can corrupt invariants and affect downstream logic that assumes the declared type.Recommendations
Update to version 4.1.30
Update to version 4.2.26
Update to version 4.3.12
Exploit
Fix
Type Confusion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Api Platform Core