CVE-2026-81892
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In EasyAdmin (an admin generator for Symfony) versions from 4.0.0 to 4.29.16 and 5.5.1, there is a vulnerability where path-based access control can be bypassed. This occurs because the controller swap happens after the firewall check, and the routeName parameter is not validated. A low-privilege user can execute another route's controller if they know its name, bypassing path-based protections. Routes that enforce their own authorization (e.g., via #[IsGranted]) remain protected. The issue is fixed in versions 4.29.16 and 5.5.1.
Risk Assessment
An attacker with low privileges in the admin panel can gain access to functions protected only by path-based rules, potentially leading to unauthorized actions in the application.
Recommendation
Update EasyAdmin to version 4.29.16 or 5.5.1 (or later) which includes a fix for this vulnerability.
Other vulnerabilities in EasyAdmin
Original NVD description (English source)
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.