← Terug naar overzicht

CVE-2026-81892 affects EasyAdmin, an admin generator for Symfony applications, across versions 4.0.0 to 4.29.16 and up to 5.5.1. The vulnerability stems from EasyAdmin routing all backend requests through a single dashboard route and swapping controllers based on an unvalidated routeName query parameter. Because Symfony's security firewall evaluates access_control rules against the original dashboard URL before the controller swap occurs, path-based access control rules protecting target routes are never evaluated. This allows a low-privilege backend user with knowledge of a target route's name to execute that route's controller, effectively bypassing path-based authorization. Routes protected by inline authorization checks such as #[IsGranted] or denyAccessUnlessGranted() remain unaffected. The vulnerability has been patched in EasyAdmin versions 4.29.16 and 5.5.1. Fixes are available via two separate commits on the EasyCorp GitHub repository.

Affected products

  • EasyAdmin 4.0.0 - 4.29.15
  • EasyAdmin 5.0.0 - 5.5.0
  • Symfony EasyAdminBundle

Related CVE's

  • CVE-2026-81892

Categories

  • Enterprise Applications
  • Identity & Access
  • Web Technologies