[php-src] Issue #22059: Unserializing enums despite `allowed_classes => false`

[email protected] (edorian)
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/22059
Author: edorian

### Description

Hi,

I'm looking for some guidance on weither this is a bug or a documentation issue.

Should `unserialize($string, ['allowed_classes' => false]);` allow the deserialization of an enum?

Given that the docs at https://www.php.net/manual/en/language.types.enumerations.php explain Enums as a layer on top of classes the intended behavior maybe at least somewhat debatable:
> Enumerations are a restricting layer on top of classes and class constants

I'd be happy with either behavior, assuming there are no potential considerations around unserializing enums. 

Either documenting or restricting this would be nice for clarity (Which I'm happy to do the docs PR for and close this issue).

---

The following code:

```php
<?php

enum TestEnum: string {
    case Foo = 'foo';
}

$serialized = serialize(TestEnum::Foo); // E:12:\"TestEnum:Foo\";

$result = unserialize(
    $serialized,
    ['allowed_classes' => false]
);

// enum(TestEnum::Foo)
var_dump($result);

```

Resulted in this output:
```
// enum(TestEnum::Foo)
```

But I expected this output instead:
```
// Either this is fine and the docs need updating
// Or it isn't and there should be an error
```


### PHP Version

```plain
PHP 8.6.0-dev (cli) (built: May 15 2026 16:51:39) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies
```

### Operating System

_No response_
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.