Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

api-platform/core

8 known vulnerabilities (3 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 3 high, 4 medium
Registry
Packagist

Advisories 8

  • CVE-2026-49858Medium 5.9

    API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

    Affected: from 2.6.0, fixed in 4.1.29; from 4.2.0, fixed in 4.2.25; from 4.3.0, fixed in 4.3.8.

  • CVE-2026-54164Medium 6.5

    API Platform Core: Missing IRI type check enables resource type confusion

    Affected: fixed in 4.1.30; from 4.2.0, fixed in 4.2.26; from 4.3.0, fixed in 4.3.12.

  • GraphQL grant on a property might be cached with different objects

    Affected: from 4.0.0-alpha.1, fixed in 4.0.22; fixed in 3.4.17; from 4.1.0-alpha.1, fixed in 4.1.5.

  • GraphQL query operations security can be bypassed

    Affected: from 4.0.0-alpha.1, fixed in 4.0.22; fixed in 3.4.17; from 4.1.0-alpha.1, fixed in 4.1.5.

  • CVE-2023-47639Medium 5.3

    API Platform Core can leak exceptions message that may contain sensitive information

    Affected: from 3.2.0, fixed in 3.2.5.

  • CVE-2025-23204Medium 4.4

    GraphQl securityAfterResolver not called

    Affected: from 3.3.8, fixed in 3.3.15.

  • Secured properties in API Platform Core may be accessible within collections

    Affected: from 3.0.0, fixed in 3.0.12; from 3.1.0, fixed in 3.1.3; from 2.6.0, fixed in 2.7.10.

  • API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in…

    Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.6.