{"vulnerability": "cve-2026-49858", "sightings": [{"uuid": "aa01435f-1c85-4a48-ac84-415f5d37e2d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49858", "type": "seen", "source": "https://bsky.app/profile/soyuka.me/post/3mnhlnpjjpc23", "content": "\ud83d\udd12 API Platform CVE-2026-49858: JSON:API & HAL normalizers cached components across users on long-running runtimes (FrankenPHP, RoadRunner, Swoole).\n\nPatched in 4.1.29 / 4.2.25 / 4.3.8 \u2014 upgrade now.\n\ngithub.com/api-platform...", "creation_timestamp": "2026-06-04T12:08:39.389097Z"}, {"uuid": "83afe1e3-1598-47ba-b7ce-081ab848cfce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49858", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mnj3tf3oaw2f", "content": "Top 3 CVE for last 7 days:\nCVE-2025-48595: 136 interactions\nCVE-2026-0257: 43 interactions\nCVE-2026-48778: 23 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-49858: 11 interactions\nCVE-2026-20230: 6 interactions\nCVE-2026-10737: 4 interactions\n", "creation_timestamp": "2026-06-05T02:30:47.601272Z"}, {"uuid": "ac0bffe5-c8cc-4049-ab5f-dc83f82311d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49858", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnxsz3fif2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-49858 \u0432 API Platform Core: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/9D910C08-1BC3-407B-B293-48AC51C1EAB3", "creation_timestamp": "2026-07-02T11:52:41.311051Z"}, {"uuid": "67ca58a5-1e7a-4e92-97e1-70b3a07feeba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49858", "type": "seen", "source": "https://gist.github.com/alon710/a56efdb02fd3817ca2ff1035bbcd74e4", "content": "# CVE-2026-49858: CVE-2026-49858: Cross-User Attribute and Relation Leak in API Platform Core Serializers\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-49858\n\n## Summary\nCVE-2026-49858 is a vulnerability in API Platform Core's JSON:API and HAL item normalizers where conditionally secured attributes are cached globally in memory. When deployed in long-running PHP execution environments such as FrankenPHP worker mode, Swoole, or RoadRunner, this persistent caching bypasses property-level security constraints, allowing unprivileged users to access sensitive, unauthorized fields cached during privileged requests.\n\n## TL;DR\nUnsafe in-memory caching in API Platform Core's JSON:API and HAL normalizers leaks sensitive properties across different user contexts when running under persistent PHP environments like FrankenPHP or RoadRunner.\n\n## Technical Details\n\n- **CWE ID**: CWE-524\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 5.9 (Medium)\n- **EPSS Score**: 0.00197\n- **Impact**: High Confidentiality Exposure\n- **Exploit Status**: None (No public exploit or PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- API Platform Core\n- api-platform/core\n- api-platform/hal\n- api-platform/json-api\n- **api-platform/core**: >= 4.1.0, < 4.1.29 (Fixed in: `4.1.29`)\n- **api-platform/core**: >= 4.2.0, < 4.2.26 (Fixed in: `4.2.26`)\n- **api-platform/core**: >= 4.3.0, < 4.3.12 (Fixed in: `4.3.12`)\n\n## Mitigation\n\n- Upgrade the API Platform Core package to version 4.1.29, 4.2.26, 4.3.12 or higher.\n- Temporarily disable persistent application workers (FrankenPHP worker mode, Swoole, RoadRunner) and fallback to stateless PHP-FPM runtime environments.\n- Decorate the SerializerContextBuilder to explicitly nullify the cache_key parameter during serialization of HAL and JSON:API formats.\n\n**Remediation Steps:**\n1. Run 'composer update api-platform/core' to pull the latest security patch.\n2. Verify the installed version of API Platform Core using 'composer show api-platform/core'.\n3. Restart long-running persistent PHP worker processes to purge any compromised cache states from memory.\n\n## References\n\n- [GHSA-pjhx-3c3w-9v23 Security Advisory](https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23)\n- [CVE-2026-49858 authoritative CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-49858)\n- [NVD - CVE-2026-49858 Detailed Report](https://nvd.nist.gov/vuln/detail/CVE-2026-49858)\n- [Fix Git Commit for ItemNormalizers Cache Key Gating](https://github.com/api-platform/core/commit/019fd901225a969b1903e093a1773f26ee551dfc)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-49858) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-10T15:41:54.376580Z"}]}