{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "api-platform/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.30"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "api-platform/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0"
            },
            {
              "fixed": "4.2.26"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "api-platform/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.3.0"
            },
            {
              "fixed": "4.3.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54164"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-843"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-07T16:54:42Z",
    "nvd_published_at": "2026-07-01T20:17:10Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe API Platform serializer\u0027s `AbstractItemNormalizer` does not validate the resource type returned when resolving relation IRIs, allowing type confusion where a resource of an unintended type can be silently assigned to a relation property.\n\n## Impact\n\nAn attacker who can submit write requests (POST/PUT/PATCH) to an API Platform endpoint with writable relations can supply a relation IRI pointing to a resource of a different type than the relation\u0027s declared class. Because `getResourceFromIri()` does not pass an `$operation` to `IriConverter::getResourceFromIri()`, the `is_a` type guard at `IriConverter.php:86` is skipped. For untyped relation properties (legacy `@var`-only style), the wrong-typed object is silently assigned, corrupting invariants and potentially feeding downstream logic that assumes the declared type (CWE-843). For typed properties (modern PHP 8.x), the substitution is blocked by Symfony\u0027s PropertyAccessor with an `InvalidTypeException`.\n\n## Affected versions\n\n- `api-platform/core` `\u003c 4.1.30`\n- `api-platform/core` `\u003e= 4.2.0, \u003c 4.2.26`\n- `api-platform/core` `\u003e= 4.3.0, \u003c 4.3.12`\n\nOlder major series (`2.x`, `3.x`) ship the same vulnerable code path and are end-of-life; no fix is planned.\n\n## Patched versions\n\n- `4.1.30`\n- `4.2.26`\n- `4.3.12`\n\n## Fix\n\nAn `is_a` guard is added inside `AbstractItemNormalizer::getResourceFromIri()` (and the equivalent inline call sites on 4.1) so that a mismatched IRI throws `InvalidArgumentException`, mirroring the operation-aware check the `IriConverter` already performs when an operation is supplied. This forces a `400 Bad Request` response for cross-type IRIs instead of a silent assignment.\n\n## Workarounds\n\nDeclare a PHP type on every writable relation property (e.g. `public ?Foo $relation = null;` instead of `@var Foo $relation`). Symfony\u0027s `PropertyAccessor` will then reject a mismatched object with `InvalidTypeException`. This does not cover collections of mixed-type interfaces; upgrading to a patched version is the only complete fix.\n\n## Proof of concept\n\nA functional test posts a `Bar` IRI to a `Foo`-declared relation on an untyped property. Without the fix the server responds with `HTTP 201` and the Bar IRI appears in the response payload. With the fix the server responds with `HTTP 400` (`Invalid IRI \"/bars/1\"`).\n\nFull PoC: `tests/Functional/Security/TypeConfusionRelationIriTest.php` in the patched branches.\n\n## References\n\n- `src/Serializer/AbstractItemNormalizer.php` \u2014 vulnerable relation IRI load\n- `src/Symfony/Routing/IriConverter.php` \u2014 conditional `is_a` guard (operation-aware path)\n\n## Credit\n\nReported by @alexandre-daubois.",
  "id": "GHSA-9rjg-x2p2-h68h",
  "modified": "2026-08-07T16:54:42Z",
  "published": "2026-08-07T16:54:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/api-platform/core/security/advisories/GHSA-9rjg-x2p2-h68h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54164"
    },
    {
      "type": "WEB",
      "url": "https://github.com/api-platform/core/commit/6bcbeb2dbee53db5bb9b4b8e343bffdf7732de1e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/api-platform/core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/api-platform/core/releases/tag/v4.1.30"
    },
    {
      "type": "WEB",
      "url": "https://github.com/api-platform/core/releases/tag/v4.2.26"
    },
    {
      "type": "WEB",
      "url": "https://github.com/api-platform/core/releases/tag/v4.3.12"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)"
}