The vulnerability in API Platform Core arises from the use of a cache keyed by $context['cache_key'] in the JSON:API and HAL item normalizers without verifying that the cache key is safe for cross-user reuse. The security predicate #[ApiProperty(security: ...)] is evaluated per request to determine property exposure, but the cached component structure (attributes, relationships, links) can be reused for subsequent requests with different user privileges. This leads to a cross-user attribute leak where a lower-privileged user may see properties intended to be hidden. The flaw is identified as CWE-524 (Use of Cache Containing Sensitive Information) and CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability affects versions from 2.6.0 up to but not including 4.1.29, 4.2.26, and 4.3.12, where it has been fixed.

An attacker with lower privileges can gain unauthorized visibility into sensitive attributes of API responses that should be restricted, due to improper caching of normalized item structures. This results in a confidentiality breach without affecting integrity or availability. The CVSS score of 5.9 reflects a medium severity impact with network attack vector, high complexity, no privileges required, no user interaction, and high confidentiality impact.

The vulnerability has been fixed in API Platform Core versions 4.1.29, 4.2.26, and 4.3.12. Users should upgrade to one of these fixed versions to remediate the issue. No vendor advisory or patch links were provided, so verify the fix availability from the official API Platform project resources. Until upgraded, be aware of potential sensitive data exposure due to caching behavior in JSON:API and HAL item normalizers.