CVE-2026-81892 affects EasyAdmin, an admin generator for Symfony applications, across versions 4.0.0 to 4.29.16 and up to 5.5.1. The vulnerability stems from EasyAdmin routing all backend requests through a single dashboard route and swapping controllers based on an unvalidated routeName query parameter. Because Symfony's security firewall evaluates access_control rules against the original dashboard URL before the controller swap occurs, path-based access control rules protecting target routes are never evaluated. This allows a low-privilege backend user with knowledge of a target route's name to execute that route's controller, effectively bypassing path-based authorization. Routes protected by inline authorization checks such as #[IsGranted] or denyAccessUnlessGranted() remain unaffected. The vulnerability has been patched in EasyAdmin versions 4.29.16 and 5.5.1. Fixes are available via two separate commits on the EasyCorp GitHub repository.