CVE-2026-54164: API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)
The API Platform serializer’s AbstractItemNormalizer does not validate the resource type returned when resolving relation IRIs, allowing type confusion where a resource of an unintended type can be silently assigned to a relation property.
References
- github.com/advisories/GHSA-9rjg-x2p2-h68h
- github.com/api-platform/core/commit/6bcbeb2dbee53db5bb9b4b8e343bffdf7732de1e
- github.com/api-platform/core/releases/tag/v4.1.30
- github.com/api-platform/core/releases/tag/v4.2.26
- github.com/api-platform/core/releases/tag/v4.3.12
- github.com/api-platform/core/security/advisories/GHSA-9rjg-x2p2-h68h
- nvd.nist.gov/vuln/detail/CVE-2026-54164
Code Behaviors & Features
Detect and mitigate CVE-2026-54164 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →