[MEDIUM] API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)

PKSA-8kfs-m8zw-ggzs CVE-2026-54164 GHSA-9rjg-x2p2-h68h

Affected package: api-platform/core

Affected version: >=4.3.0,<4.3.12|>=4.2.0,<4.2.26|<4.1.30

Reported by:
GitHub