deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-cvm2-5f78-g9m8
Package: typo3/cms-core (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 12.0.0, < 12.4.37
Patched in: 12.4.37

Summary: TYPO3 CMS exposes sensitive information in an error message

Details:
Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations.
GitHub Security Advisory: GHSA-cvm2-5f78-g9m8
Package: typo3/cms-core (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 11.0.0, < 11.5.48
Patched in: 12.4.37

Summary: TYPO3 CMS exposes sensitive information in an error message

Details:
Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations.
GitHub Security Advisory: GHSA-cvm2-5f78-g9m8
Package: typo3/cms-core (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 10.0.0, < 10.4.54
Patched in: 12.4.37

Summary: TYPO3 CMS exposes sensitive information in an error message

Details:
Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations.
GitHub Security Advisory: GHSA-cvm2-5f78-g9m8
Package: typo3/cms-core (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 9.0.0, < 9.5.55
Patched in: 12.4.37

Summary: TYPO3 CMS exposes sensitive information in an error message

Details:
Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations.
GitHub Security Advisory: GHSA-p5jq-5383-qvc7
Package: typo3/cms-core (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-331: Insufficient Entropy
Vulnerable versions: >= 13.0.0, < 13.4.18
Patched in: 13.4.18

Summary: TYPO3 CMS uses insufficient entropy when generating passwords

Details:
A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.
GitHub Security Advisory: GHSA-p5jq-5383-qvc7
Package: typo3/cms-core (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-331: Insufficient Entropy
Vulnerable versions: >= 12.0.0, < 12.4.37
Patched in: 12.4.37

Summary: TYPO3 CMS uses insufficient entropy when generating passwords

Details:
A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.
GitHub Security Advisory: GHSA-xrcq-533q-8rxw
Package: typo3/cms-backend (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: >= 13.0.0, < 13.4.18
Patched in: 13.4.18

Summary: TYPO3 Bookmark Toolbar vulnerable to denial of service

Details:
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar.
GitHub Security Advisory: GHSA-xrcq-533q-8rxw
Package: typo3/cms-backend (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: >= 12.0.0, < 12.4.37
Patched in: 12.4.37

Summary: TYPO3 Bookmark Toolbar vulnerable to denial of service

Details:
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar.
GitHub Security Advisory: GHSA-xrcq-533q-8rxw
Package: typo3/cms-backend (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: >= 11.0.0, < 11.5.48
Patched in: 12.4.37

Summary: TYPO3 Bookmark Toolbar vulnerable to denial of service

Details:
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar.
GitHub Security Advisory: GHSA-72jf-5fg5-3cw3
Package: typo3/cms-core (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 13.0.0, < 13.4.18
Patched in: 13.4.18

Summary: TYPO3 CMS has an open‑redirect vulnerability

Details:
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.
GitHub Security Advisory: GHSA-72jf-5fg5-3cw3
Package: typo3/cms-core (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 12.0.0, < 12.4.37
Patched in: 12.4.37

Summary: TYPO3 CMS has an open‑redirect vulnerability

Details:
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.
GitHub Security Advisory: GHSA-72jf-5fg5-3cw3
Package: typo3/cms-core (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 11.0.0, < 11.5.48
Patched in: 12.4.37

Summary: TYPO3 CMS has an open‑redirect vulnerability

Details:
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.
GitHub Security Advisory: GHSA-72jf-5fg5-3cw3
Package: typo3/cms-core (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 10.0.0, < 10.4.54
Patched in: 12.4.37

Summary: TYPO3 CMS has an open‑redirect vulnerability

Details:
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.
GitHub Security Advisory: GHSA-72jf-5fg5-3cw3
Package: typo3/cms-core (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 9.0.0, < 9.5.55
Patched in: 12.4.37

Summary: TYPO3 CMS has an open‑redirect vulnerability

Details:
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.
GitHub Security Advisory: GHSA-8xx5-h6m3-jr33
Package: prestashop/prestashop (COMPOSER)
Severity: MODERATE (CVSS 4.2)
CWE: CWE-203: Observable Discrepancy, CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Vulnerable versions: < 8.2.3
Patched in: 8.2.3

Summary: Presta Shop vulnerable to email enumeration 

Details:
### Impact
An unauthenticated attacker with access to the back-office URL can manipulate the id_employee and reset_token parameters to enumerate valid back-office employee email addresses.

Impacted parties:
Store administrators and employees: their email addresses are exposed.
Merchants: risk of phishing, social engineering, and brute-force attacks targeting admin accounts.

### Patches
PrestaShop 8.2.3

### Workarounds
You must upgrade, or at least apply the changes from the PrestaShop 8.2.3 patch. More information: https://build.prestashop-project.org/news/2025/prestashop-8-2-3-security-release/
GitHub Security Advisory: GHSA-3ggv-qwcp-j6xg
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-204: Observable Response Discrepancy
Vulnerable versions: >= 6.0.0-alpha, < 6.0.5
Patched in: 6.0.5

Summary: Mautic Vulnerable to User Enumeration via Response Timing

Details:
### Impact
The attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks.

### Patches
This vulnerability has been patched, implementing a timing-safe form login authenticator that ensures consistent response times regardless of whether a user exists or not.

### Technical Details
The vulnerability was caused by different response times when:
- A valid username was provided (password hashing occurred)
- An invalid username was provided (no password hashing occurred)

The fix introduces a `TimingSafeFormLoginAuthenticator` that performs a dummy password hash verification even for non-existent users, ensuring consistent timing.

### Workarounds
No workarounds are available. Users should upgrade to the patched version.

### References
- https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account
- https://github.com/mautic/mautic-security/pull/146
GitHub Security Advisory: GHSA-3ggv-qwcp-j6xg
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-204: Observable Response Discrepancy
Vulnerable versions: >= 5.0.0-alpha, < 5.2.8
Patched in: 5.2.8

Summary: Mautic Vulnerable to User Enumeration via Response Timing

Details:
### Impact
The attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks.

### Patches
This vulnerability has been patched, implementing a timing-safe form login authenticator that ensures consistent response times regardless of whether a user exists or not.

### Technical Details
The vulnerability was caused by different response times when:
- A valid username was provided (password hashing occurred)
- An invalid username was provided (no password hashing occurred)

The fix introduces a `TimingSafeFormLoginAuthenticator` that performs a dummy password hash verification even for non-existent users, ensuring consistent timing.

### Workarounds
No workarounds are available. Users should upgrade to the patched version.

### References
- https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account
- https://github.com/mautic/mautic-security/pull/146
GitHub Security Advisory: GHSA-3ggv-qwcp-j6xg
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-204: Observable Response Discrepancy
Vulnerable versions: >= 4.4.0, < 4.4.17
Patched in: 4.4.17

Summary: Mautic Vulnerable to User Enumeration via Response Timing

Details:
### Impact
The attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks.

### Patches
This vulnerability has been patched, implementing a timing-safe form login authenticator that ensures consistent response times regardless of whether a user exists or not.

### Technical Details
The vulnerability was caused by different response times when:
- A valid username was provided (password hashing occurred)
- An invalid username was provided (no password hashing occurred)

The fix introduces a `TimingSafeFormLoginAuthenticator` that performs a dummy password hash verification even for non-existent users, ensuring consistent timing.

### Workarounds
No workarounds are available. Users should upgrade to the patched version.

### References
- https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account
- https://github.com/mautic/mautic-security/pull/146
GitHub Security Advisory: GHSA-9v8p-m85m-f7mm
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.0.0-alpha, < 6.0.5
Patched in: 6.0.5

Summary: Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add

Details:
## Summary

A Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s session. This occurs because user-supplied input is reflected back in the server’s response without proper sanitization or escaping, potentially enabling malicious actions such as session hijacking, credential theft, or unauthorized actions in the application.

## Details

The vulnerability resides in the “Tags” input field on the /s/ajax?action=lead:addLeadTags endpoint. Although the server applies sanitization before storing the data or returning it later, the payload is executed immediately in the victim’s browser upon reflection, allowing an attacker to run arbitrary JavaScript in the user’s session.

## Impact
A Reflected XSS attack can have a significant impact, allowing attackers to steal sensitive user data like cookies, redirect users to malicious websites, manipulate the web page content, and essentially take control of a user's session within an application by executing malicious JavaScript code within the victim's browser, even if the server-side code is secure; essentially enabling them to perform actions as if they were the logged-in user.

## References
- [Web Security Academy: Cross-site scripting](https://portswigger.net/web-security/cross-site-scripting)
- [Web Security Academy: Reflected cross-site scripting](https://portswigger.net/web-security/cross-site-scripting/reflected)
GitHub Security Advisory: GHSA-9v8p-m85m-f7mm
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.0-alpha, < 5.2.8
Patched in: 5.2.8

Summary: Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add

Details:
## Summary

A Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s session. This occurs because user-supplied input is reflected back in the server’s response without proper sanitization or escaping, potentially enabling malicious actions such as session hijacking, credential theft, or unauthorized actions in the application.

## Details

The vulnerability resides in the “Tags” input field on the /s/ajax?action=lead:addLeadTags endpoint. Although the server applies sanitization before storing the data or returning it later, the payload is executed immediately in the victim’s browser upon reflection, allowing an attacker to run arbitrary JavaScript in the user’s session.

## Impact
A Reflected XSS attack can have a significant impact, allowing attackers to steal sensitive user data like cookies, redirect users to malicious websites, manipulate the web page content, and essentially take control of a user's session within an application by executing malicious JavaScript code within the victim's browser, even if the server-side code is secure; essentially enabling them to perform actions as if they were the logged-in user.

## References
- [Web Security Academy: Cross-site scripting](https://portswigger.net/web-security/cross-site-scripting)
- [Web Security Academy: Reflected cross-site scripting](https://portswigger.net/web-security/cross-site-scripting/reflected)
GitHub Security Advisory: GHSA-9v8p-m85m-f7mm
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.4.0, < 4.4.17
Patched in: 4.4.17

Summary: Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add

Details:
## Summary

A Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s session. This occurs because user-supplied input is reflected back in the server’s response without proper sanitization or escaping, potentially enabling malicious actions such as session hijacking, credential theft, or unauthorized actions in the application.

## Details

The vulnerability resides in the “Tags” input field on the /s/ajax?action=lead:addLeadTags endpoint. Although the server applies sanitization before storing the data or returning it later, the payload is executed immediately in the victim’s browser upon reflection, allowing an attacker to run arbitrary JavaScript in the user’s session.

## Impact
A Reflected XSS attack can have a significant impact, allowing attackers to steal sensitive user data like cookies, redirect users to malicious websites, manipulate the web page content, and essentially take control of a user's session within an application by executing malicious JavaScript code within the victim's browser, even if the server-side code is secure; essentially enabling them to perform actions as if they were the logged-in user.

## References
- [Web Security Academy: Cross-site scripting](https://portswigger.net/web-security/cross-site-scripting)
- [Web Security Academy: Reflected cross-site scripting](https://portswigger.net/web-security/cross-site-scripting/reflected)
GitHub Security Advisory: GHSA-438m-6mhw-hq5w
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-283: Unverified Ownership
Vulnerable versions: >= 6.0.0-alpha, < 6.0.5
Patched in: 6.0.5

Summary: Mautic vulnerable to secret data extraction via elfinder

Details:
### Summary
_A user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available._


### Impact
_An administrator who usually does not have access to certain parameters, such as database credentials, can disclose them._
GitHub Security Advisory: GHSA-438m-6mhw-hq5w
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-283: Unverified Ownership
Vulnerable versions: >= 5.0.0-alpha, < 5.2.8
Patched in: 5.2.8

Summary: Mautic vulnerable to secret data extraction via elfinder

Details:
### Summary
_A user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available._


### Impact
_An administrator who usually does not have access to certain parameters, such as database credentials, can disclose them._
GitHub Security Advisory: GHSA-438m-6mhw-hq5w
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-283: Unverified Ownership
Vulnerable versions: >= 4.4.0, < 4.4.17
Patched in: 4.4.17

Summary: Mautic vulnerable to secret data extraction via elfinder

Details:
### Summary
_A user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available._


### Impact
_An administrator who usually does not have access to certain parameters, such as database credentials, can disclose them._
GitHub Security Advisory: GHSA-hj6f-7hp7-xg69
Package: mautic/core (COMPOSER)
Severity: LOW (CVSS 2.7)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 6.0.0-alpha, < 6.0.5
Patched in: 6.0.5

Summary: Mautic vulnerable to SSRF via webhook function

Details:
### Summary
Users with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed

### Details
When sending webhooks, the destination is not validated, causing SSRF.

### Impact
Bypass of firewalls to interact with internal services. 
See https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ for more potential impact.

### Resources
https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html for more information on SSRF and its fix
GitHub Security Advisory: GHSA-hj6f-7hp7-xg69
Package: mautic/core (COMPOSER)
Severity: LOW (CVSS 2.7)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 5.0.0-alpha, < 5.2.8
Patched in: 5.2.8

Summary: Mautic vulnerable to SSRF via webhook function

Details:
### Summary
Users with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed

### Details
When sending webhooks, the destination is not validated, causing SSRF.

### Impact
Bypass of firewalls to interact with internal services. 
See https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ for more potential impact.

### Resources
https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html for more information on SSRF and its fix
GitHub Security Advisory: GHSA-hj6f-7hp7-xg69
Package: mautic/core (COMPOSER)
Severity: LOW (CVSS 2.7)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 4.4.0, < 4.4.17
Patched in: 4.4.17

Summary: Mautic vulnerable to SSRF via webhook function

Details:
### Summary
Users with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed

### Details
When sending webhooks, the destination is not validated, causing SSRF.

### Impact
Bypass of firewalls to interact with internal services. 
See https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ for more potential impact.

### Resources
https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html for more information on SSRF and its fix
GitHub Security Advisory: GHSA-428q-q3vv-3fq3
Package: api-platform/graphql (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-696: Incorrect Behavior Order
Vulnerable versions: >= 4.1.0-alpha.1, < 4.1.5
Patched in: 4.1.5

Summary: GraphQL grant on a property might be cached with different objects

Details:
### Original message:

I found an issue with security grants on on properties in the GraphQL ItemNormalizer:

If you use something like `#[ApiProperty(security: 'is_granted("PROPERTY_READ", [object, property])')]` on a member of an entity, the grant gets cached and is only evaluated once, even if the `object` in question is a different one.

There is the `ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe()` method that seems to be intended to prevent this: https://github.com/api-platform/core/blob/88f5ac50d20d6510686a7552310cc567fcca45bf/src/GraphQl/Serializer/ItemNormalizer.php#L160-L164  
and in its usage on line 90 it does indeed not create a cache key, but the `parent::normalize()` that is called afterwards still creates the cache key and causes the issue.

### Impact

It grants access to properties that it should not.

### Workarounds

Override the ItemNormalizer.

Patched at: https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8