DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54164: CVE-2026-54164: Missing IRI Type Validation in API Platform Core Enables Resource Type Confusion

#security #cve #cybersecurity

CVE-2026-54164: Missing IRI Type Validation in API Platform Core Enables Resource Type Confusion

Vulnerability ID: CVE-2026-54164
CVSS Score: 6.5
Published: 2026-08-07

CVE-2026-54164 is a class/type confusion vulnerability (CWE-843) in API Platform Core. When processing relationships via Internationalized Resource Identifiers (IRIs) in write requests, the framework's normalizer fails to verify if the resolved resource matches the expected type. For PHP applications utilizing untyped properties, the mismatched object is silently assigned, breaking domain logic and data integrity.

TL;DR

API Platform Core failed to validate resource types retrieved via relation IRIs, causing Type Confusion in environments with untyped properties.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-843
  • Attack Vector: Network
  • CVSS v3.1: 6.5 (Medium)
  • EPSS Score: 0.00195
  • Exploit Status: poc
  • CISA KEV: Not Listed

Affected Systems

  • API Platform Core
  • API Platform Core: < 4.1.30 (Fixed in: 4.1.30)
  • API Platform Core: >= 4.2.0, < 4.2.26 (Fixed in: 4.2.26)
  • API Platform Core: >= 4.3.0, < 4.3.12 (Fixed in: 4.3.12)

Code Analysis

Commit: 6bcbeb2

Ensure IRI resolved resource class matches declared target class

Commit: 0720d3b

Fix type confusion in older branches during relation denormalization

Exploit Details

  • GitHub Security Advisory: The advisory details vulnerability mechanics and references core test suites demonstrating the type confusion exploit.

Mitigation Strategies

  • Upgrade API Platform Core to secure releases: 4.1.30, 4.2.26, or 4.3.12.
  • Refactor entity properties to use strict, native PHP type-hints instead of loose PHPDoc annotations.

Remediation Steps:

  1. Identify the currently installed version of api-platform/core by running 'composer show api-platform/core'.
  2. Update your dependencies using Composer by running 'composer update api-platform/core'.
  3. Verify the installation of fixed versions (>=4.1.30, >=4.2.26, or >=4.3.12).
  4. Review application entities for loose properties and apply native PHP strict type declarations.

References

Read the full report for CVE-2026-54164 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)