CVE-2026-49858: API Platform Cross-User Attribute Leak via Cache Bypass

Technical summary

The vulnerability resides in the JSON:API and HAL serializers within API Platform's normalization pipeline. Both ItemNormalizer classes use a componentsCache keyed on context['cache_key'], which is set before the parent normalizer processes security gates. When a request is normalized, the computed component structure—including which attributes, relationships, and links are present—is cached using this key. If a subsequent request with a different user (and thus different access permissions) has the same cache_key, the normalizer reuses the cached structure from the first request. Since security predicates are evaluated per-request via #[ApiProperty(security: ...)], but the cache is not segmented by security context, a lower-privileged user can observe the presence of properties that should be hidden from them. The fix introduces an isCacheKeySafe gate that ensures the cache key incorporates user-specific authorization state, preventing cross-user information leakage. Affected CWEs are CWE-524 (Clojure/Guile/Lisp Macro Injection, though here representing generic closure/context issues) and CWE-639 (Authorization Bypass Through User-Controlled Key).

Business impact

This vulnerability enables privilege escalation through information disclosure. An attacker with low or no authentication can infer the existence and structure of sensitive data fields in your API, which may include business logic details, internal naming conventions, and metadata about restricted resources. While the actual values remain protected, knowledge of hidden properties can guide further attacks, enable social engineering, or reveal competitive intelligence. For platforms handling regulated data (healthcare, finance, PII), even disclosure of field names can trigger compliance violations. The impact is heightened in multi-tenant systems where one tenant's schema structure might leak to another.

Affected systems

API Platform versions 2.6.0 through 4.1.28 (inclusive), 4.2.25 (inclusive), and 4.3.11 (inclusive) are vulnerable. The issue affects applications using the JSON:API or HAL serializers with role-based or attribute-level security predicates. Applications relying solely on GraphQL or using alternative serializers may be less affected. Any deployment where API Platform serves as the serialization layer for REST endpoints with fine-grained access control should be considered at risk.

Exploitability

The vulnerability requires only network access to the vulnerable API endpoint; no authentication or special privileges are needed to trigger the initial information leak. However, exploiting it fully requires either authenticated access or endpoint visibility. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects high confidentiality impact but notes elevated attack complexity, likely due to cache timing and the need to align requests properly. Real-world exploitation would involve repeatedly querying endpoints to observe differences in response structure based on authentication context, then correlating those differences to infer hidden properties. No public exploit code has been reported, and the vulnerability is not tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Upgrade to API Platform version 4.1.29, 4.2.26, or 4.3.12 or later, depending on your currently deployed major/minor version. The fix adds proper cache-key validation that includes user-specific security context, ensuring that cached normalizer output is not shared across requests with different authorization states. After patching, verify that custom serializers or cached responses (Redis, Varnish, CDN) do not inadvertently re-expose the vulnerability by caching at higher layers without user differentiation.

Patch guidance

1. Identify your current API Platform version via composer show or package.json. 2. For 4.1.x users: update to 4.1.29 or later. 3. For 4.2.x users: update to 4.2.26 or later. 4. For 4.3.x users: update to 4.3.12 or later. 5. For users on 2.6.0–4.0.x: evaluate your upgrade path carefully; consider moving to 4.3.x if feasible, or contact Symfony/API Platform support. 6. Run full regression tests on JSON:API and HAL endpoints, especially those with security predicates. 7. Clear any external caches (Redis, CDN) that may hold pre-patch responses. 8. Monitor logs for any suspicious API access patterns during the transition.

Detection guidance

Review API Platform configurations for use of #[ApiProperty(security: ...)] annotations and HAL/JSON:API serializers. Audit logs may show repeated requests to the same endpoint from different users within short timeframes, suggesting cache hits. Check whether your API responses are being cached externally; if so, ensure cache keys include user identity or role. Conduct a manual test: as a low-privilege user, inspect API response structure for fields marked as hidden; if structure differs between privileged and unprivileged users, the cache is working correctly post-patch. Use API security scanning tools (e.g., Burp, ZAP) to test for information disclosure via repeated authorization context changes.

Why prioritize this

Although this is a MEDIUM severity vulnerability, it poses a notable risk in any environment where API structure or metadata is considered sensitive. The attack surface is broad (any REST/GraphQL endpoint), no authentication is required, and the flaw is subtle—easy to overlook in code review. For organizations handling regulated data or multi-tenant systems, prioritize patching over lower-priority MEDIUM issues. The high attack complexity (AC:H) suggests it requires specific timing or alignment, so immediate exploitation risk is lower than a similar MEDIUM-rated flaw with AC:L. Still, timely patching within 1–2 months is advisable to close an information-disclosure window.

Risk score, explained

The CVSS 5.9 score balances high confidentiality impact (C:H—complete information disclosure) against elevated attack complexity (AC:H) and the requirement for network proximity (AV:N). No authentication is required (PR:N), and the vulnerability does not affect availability or integrity, so those metrics are neutral. The score reflects a real but not immediately critical risk: an attacker must align requests to trigger cache reuse, and the leak is limited to field names/structure rather than data values. For environments with strict information classification, consider raising the priority above the base score.

Frequently asked questions