Packagist/api-platform/core

GraphQL grant on a property might be cached with different objects

Modified: 8/29/2025

API Platform Core does not call GraphQl securityAfterResolver

Modified: 3/24/2025

Incorrect Access Control vulnerability in api-platform/core

Modified: 11/8/2023

API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)

Modified: 8/7/2026

GraphQL query operations security can be bypassed

Modified: 8/29/2025

API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

Modified: 7/10/2026

API Platform Core can leak exceptions message that may contain sensitive information

Modified: 4/4/2025

api-platform/core's secured properties may be accessible within collections

Modified: 9/10/2026