If you have found any issues that might have security implications, please read reporting instructions in our security policy.
PLEASE DO NOT PUBLISH SECURITY REPORTS PUBLICLY.
Security: api-platform/core
Security
.github/SECURITY.md
-
Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)GHSA-9rjg-x2p2-h68h published
Jun 13, 2026 by soyukaModerate -
Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gateGHSA-pjhx-3c3w-9v23 published
Jun 4, 2026 by soyukaModerate -
GraphQL grant on a property might be cached with different objectsGHSA-428q-q3vv-3fq3 published
Apr 3, 2025 by soyukaHigh -
GraphQL query operations security can be bypassedGHSA-cg3c-245w-728m published
Apr 3, 2025 by soyukaHigh -
GraphQl securityAfterResolver not calledGHSA-7mxx-3cgm-xxv3 published
Mar 24, 2025 by dunglasModerate -
Exceptions message that may contain sensitive information can leakGHSA-rfw5-cqjj-7v9r published
Apr 3, 2025 by soyukaModerate -
Secured properties may be accessible within collectionsGHSA-vr2x-7687-h6qv published
Feb 28, 2023 by dunglasHigh
Learn more about advisories related to api-platform/core in the GitHub Advisory Database