StackRadarChart IndexLive demo

CVE-2026-49858

Medium

Advisory

Published 10 Jul 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 18; of 17,781 indexed, latest versions
Container images: 14; deployed by those charts
Fix available: 1 of 1; affected package

API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

Carried by container images the latest versions of 18 of 17,781 indexed charts deploy, on 14 images.

Affected package	Affected versions	Fixed in	Images
api-platform/corecomposer	v2.6.5, v2.6.6, v2.6.8, v4.3.7	4.1.29, 4.3.8	14

OSV records: GHSA-pjhx-3c3w-9v23

Charts affected

18 by stars

Chart

Latest

Affected images

Radar Score

brpservicebrpservice

1 of 4 See more

brpservice brpservice 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/brpservice-php :latest	c17f1ba17d36	api-platform/core@v2.6.5	4.1.29

Open the chart page →

7,830

commonground-gatewaycommonground-gateway

1 of 7 See more

commonground-gateway commonground-gateway 1.5.4

1 of the 7 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/commonground-gateway-php :latest	947882bf2c37	api-platform/core@v2.6.5	4.1.29

Open the chart page →

9,724

contactcataloguscontact-catalogus

1 of 3 See more

contactcatalogus contact-catalogus 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/contactcatalogus-php :latest	eeb625bd660c	api-platform/core@v2.6.8	4.1.29

Open the chart page →

7,303

digispoof-interfacedigispoof-interface

1 of 3 See more

digispoof-interface digispoof-interface 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/digispoof-interface-php :latest	03aba499950f	api-platform/core@v2.6.6	4.1.29

Open the chart page →

7,779

opencatalogiopencatalogi

1 of 8 See more

opencatalogi opencatalogi 1.0.6

1 of the 8 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/commonground-gateway-php :latest	947882bf2c37	api-platform/core@v2.6.5	4.1.29

Open the chart page →

14,838

user-componentuser-component

1 of 4 See more

user-component user-component 1.2.0

1 of the 4 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/user-component-php :latest	198db44fabb5	api-platform/core@v2.6.6	4.1.29

Open the chart page →

7,303

authorization-componentauthorization-component

1 of 3 See more

authorization-component authorization-component 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/authorization-component-php :latest	94a749392fcf	api-platform/core@v2.6.5	4.1.29

Open the chart page →

7,561

berichtserviceberichtservice

1 of 3 See more

berichtservice berichtservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/berichtservice-php :latest	ee6a21e66ff0	api-platform/core@v2.6.8	4.1.29

Open the chart page →

7,342

commonground-gatewaycommonground-gateway-frontend

1 of 4 See more

commonground-gateway commonground-gateway-frontend 0.1.5

1 of the 4 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/commonground-gateway-php :latest	947882bf2c37	api-platform/core@v2.6.5	4.1.29

Open the chart page →

2,825

eav-componenteav-component

1 of 3 See more

eav-component eav-component 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/eav-component-php :latest	24bbca4a52a8	api-platform/core@v2.6.8	4.1.29

Open the chart page →

7,255

education-componenteducation-component

1 of 3 See more

education-component education-component 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/education-component-php :latest	da6b05a1a601	api-platform/core@v2.6.8	4.1.29

Open the chart page →

7,327

logicservicelogicservice

1 of 4 See more

logicservice logicservice 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/logicservice-php :latest	72aae2080595	api-platform/core@v2.6.5	4.1.29

Open the chart page →

7,499

mauticmautic-chart

1 of 3 See more

mautic mautic-chart 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
mautic/mautic :7-apache	eb8cc73d97e1	api-platform/core@v4.3.7	4.3.8

Open the chart page →

8,303

medewerkercatalogusmedewerkercatalogus

1 of 3 See more

medewerkercatalogus medewerkercatalogus 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/medewerkercatalogus-php :latest	1ea5412bed26	api-platform/core@v2.6.8	4.1.29

Open the chart page →

7,327

commonground-gatewayopencatalogi

1 of 7 See more

commonground-gateway opencatalogi 1.5.3

1 of the 7 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/commonground-gateway-php :latest	947882bf2c37	api-platform/core@v2.6.5	4.1.29

Open the chart page →

9,724

commonground-gatewayskeleton-pip

1 of 5 See more

commonground-gateway skeleton-pip 0.1.7

1 of the 5 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/commonground-gateway-php :latest	947882bf2c37	api-platform/core@v2.6.5	4.1.29

Open the chart page →

2,825

taalhuizen-servicetaalhuizen-service

1 of 3 See more

taalhuizen-service taalhuizen-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/taalhuizen-service-php :latest	04f1b7f0d573	api-platform/core@v2.6.5	4.1.29

Open the chart page →

7,480

webresourcecataloguswebresourcecatalogus

1 of 4 See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-49858.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/webresourcecatalogus-php :latest	8f1bbd5cda85	api-platform/core@v2.6.8	4.1.29

Open the chart page →

7,552

Container images carrying it

14 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/conductionnl/commonground-gateway-php :latest	947882bf2c37	api-platform/core@v2.6.5	4.1.29	5
mautic/mautic :7-apache	eb8cc73d97e1	api-platform/core@v4.3.7	4.3.8	1
ghcr.io/conductionnl/authorization-component-php :latest	94a749392fcf	api-platform/core@v2.6.5	4.1.29	1
ghcr.io/conductionnl/berichtservice-php :latest	ee6a21e66ff0	api-platform/core@v2.6.8	4.1.29	1
ghcr.io/conductionnl/brpservice-php :latest	c17f1ba17d36	api-platform/core@v2.6.5	4.1.29	1
ghcr.io/conductionnl/contactcatalogus-php :latest	eeb625bd660c	api-platform/core@v2.6.8	4.1.29	1
ghcr.io/conductionnl/digispoof-interface-php :latest	03aba499950f	api-platform/core@v2.6.6	4.1.29	1
ghcr.io/conductionnl/eav-component-php :latest	24bbca4a52a8	api-platform/core@v2.6.8	4.1.29	1
ghcr.io/conductionnl/education-component-php :latest	da6b05a1a601	api-platform/core@v2.6.8	4.1.29	1
ghcr.io/conductionnl/logicservice-php :latest	72aae2080595	api-platform/core@v2.6.5	4.1.29	1
ghcr.io/conductionnl/medewerkercatalogus-php :latest	1ea5412bed26	api-platform/core@v2.6.8	4.1.29	1
ghcr.io/conductionnl/taalhuizen-service-php :latest	04f1b7f0d573	api-platform/core@v2.6.5	4.1.29	1
ghcr.io/conductionnl/user-component-php :latest	198db44fabb5	api-platform/core@v2.6.6	4.1.29	1
ghcr.io/conductionnl/webresourcecatalogus-php :latest	8f1bbd5cda85	api-platform/core@v2.6.8	4.1.29	1