{"uuid": "869fa017-d0d1-4d61-91ea-72b9a77ab140", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54164", "type": "seen", "source": "https://gist.github.com/alon710/78794a04f6eb67dcf53fb32270be19e1", "content": "# CVE-2026-54164: CVE-2026-54164: Missing IRI Type Validation in API Platform Core Enables Resource Type Confusion\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54164\n\n## Summary\nCVE-2026-54164 is a class/type confusion vulnerability (CWE-843) in API Platform Core. When processing relationships via Internationalized Resource Identifiers (IRIs) in write requests, the framework's normalizer fails to verify if the resolved resource matches the expected type. For PHP applications utilizing untyped properties, the mismatched object is silently assigned, breaking domain logic and data integrity.\n\n## TL;DR\nAPI Platform Core failed to validate resource types retrieved via relation IRIs, causing Type Confusion in environments with untyped properties.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-843\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.5 (Medium)\n- **EPSS Score**: 0.00195\n- **Exploit Status**: poc\n- **CISA KEV**: Not Listed\n\n## Affected Systems\n\n- API Platform Core\n- **API Platform Core**: < 4.1.30 (Fixed in: `4.1.30`)\n- **API Platform Core**: >= 4.2.0, < 4.2.26 (Fixed in: `4.2.26`)\n- **API Platform Core**: >= 4.3.0, < 4.3.12 (Fixed in: `4.3.12`)\n\n## Mitigation\n\n- Upgrade API Platform Core to secure releases: 4.1.30, 4.2.26, or 4.3.12.\n- Refactor entity properties to use strict, native PHP type-hints instead of loose PHPDoc annotations.\n\n**Remediation Steps:**\n1. Identify the currently installed version of api-platform/core by running 'composer show api-platform/core'.\n2. Update your dependencies using Composer by running 'composer update api-platform/core'.\n3. Verify the installation of fixed versions (>=4.1.30, >=4.2.26, or >=4.3.12).\n4. Review application entities for loose properties and apply native PHP strict type declarations.\n\n## References\n\n- [GitHub Security Advisory GHSA-9rjg-x2p2-h68h](https://github.com/api-platform/core/security/advisories/GHSA-9rjg-x2p2-h68h)\n- [NVD - CVE-2026-54164](https://nvd.nist.gov/vuln/detail/CVE-2026-54164)\n- [CVE-2026-54164 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-54164)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54164) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T17:31:49.742677Z"}