The flaw arises because the serializer in API Platform Core fails to confirm that the class of a resource resolved from an IRI matches the expected type for a relation. An attacker who can submit write requests (POST/PUT/PATCH) to an API endpoint that exposes writable relations can provide a custom IRI that points to a different resource type. On legacy untyped properties the framework silently assigns the wrong‑typed object, happily corrupting data consistency and potentially feeding downstream logic that assumes the declared type. For modern typed properties Symfony’s PropertyAccessor blocks the substitution and throws an InvalidTypeException, but the silent corruption risk remains for legacy code. The vulnerability is a classic instance of type confusion (CWE‑843). The impacted behavior can lead to silently stored references that do not match the entity schema, which in turn may break application invariants, trigger errors later in the request cycle, or make downstream services operate on unexpected data. This issue does not provide an execution path for arbitrary code or direct denial of service; the primary threat is data integrity and the potential for subtle logic errors that could cascade into larger faults if unchecked.

API Platform Core is the affected product. Versions prior to 4.1.30, 4.2.26 and 4.3.12 are vulnerable; all releases equal to or newer than those values contain the fix.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % shows a very low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to send a crafted IRI in a writable API request. If successful, the attacker can corrupt data integrity silently on systems that use legacy untyped relation properties, or observe a type mismatch exception with typed properties. The attack vector remains confined to the application layer and does not grant remote code execution or broader system compromise.