The serializer in API Platform Core fails to confirm that the class of a resource resolved from an IRI matches the relation’s declared type, allowing a crafted IRI to reference an unintended resource type. An attacker who can send write requests (POST/PUT/PATCH) to an endpoint whose relations are writable may supply such an IRI. For legacy untyped properties the framework silently assigns the wrong‑typed object, corrupting data consistency and potentially feeding downstream logic that expects the declared type. For modern typed properties Symfony’s PropertyAccessor blocks the substitution and throws an InvalidTypeException, but the silent corruption risk remains for legacy code.

API Platform Core is the affected product. Versions prior to 4.1.30, 4.2.26 and 4.3.12 are vulnerable; releases equal to or newer than those values contain the fix.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % shows a very low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to send a crafted IRI in a writable API request; successful exploitation can silently corrupt data on systems that use legacy untyped relation properties, or trigger a type mismatch exception on typed properties. The attack vector remains confined to the application layer and does not provide remote code execution or broader system compromise.