{"id":"CVE-2026-81892","aliases":["GHSA-g2fm-8hr4-j82h"],"url":"https://o3.security/vulnerability/CVE-2026-81892","summary":"EasyAdmin custom-action dispatcher bypasses access_control on other routes","details":"## Summary\n\nEasyAdmin serves all backend requests through a single dashboard route and, for custom actions (`Action::linkToRoute()` / `MenuItem::linkToRoute()`), swaps the executed controller based on the `routeName` query parameter on the `kernel.controller` event.\n\nThat swap happens **after** Symfony's security firewall has already evaluated `access_control` against the original dashboard URL, and the `routeName` value was not validated. As a result, a path-based `access_control` rule protecting the *target* route was never evaluated, so a low-privilege backend user could reach a more restricted route by name.\n\n## Impact\n\nAny application where `access_control` (or another path-based Symfony security rule) protects some routes more strictly than the dashboard URL used to reach EasyAdmin. An attacker who can reach a single EasyAdmin URL and knows a target route's **name** can execute that route's controller, bypassing the path-based rule.\n\nOnly **path-based** protections are bypassed. Routes whose controller enforces its own authorization with `#[IsGranted]` / `denyAccessUnlessGranted()` remain protected, because those checks are recomputed against the swapped-in controller.\n\n## Patches\n\nFixed in **4.29.16** and **5.5.1**. Before dispatching a custom-action route, EasyAdmin now re-evaluates the target route's `access_control` rule and denies the request if the current user is not granted access.\n\n## Workarounds\n\nAdd controller-level authorization (`#[IsGranted]` / `denyAccessUnlessGranted()`) to any sensitive route, since controller-level checks are still enforced. Upgrading is the recommended fix.\n\n## Credits\n\nReported by @TungNGo02.","published":"2026-08-31T20:38:06.196Z","modified":"2026-09-11T03:30:54.606528717Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"epss":{"score":0.0025,"percentile":0.16568,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"easycorp/easyadmin-bundle","fixedVersion":"4.29.16"},{"ecosystem":"Packagist","name":"easycorp/easyadmin-bundle","fixedVersion":"5.5.1"}],"fix":{"url":"https://github.com/EasyCorp/EasyAdminBundle/commit/03be45c6b7213c4c984a1d0542b7ec60359329f8","label":"EasyCorp/EasyAdminBundle@03be45c"},"references":[{"type":"WEB","url":"https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v4.29.16"},{"type":"WEB","url":"https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.5.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81892.json"},{"type":"ADVISORY","url":"https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-g2fm-8hr4-j82h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81892"},{"type":"FIX","url":"https://github.com/EasyCorp/EasyAdminBundle/commit/03be45c6b7213c4c984a1d0542b7ec60359329f8"},{"type":"FIX","url":"https://github.com/EasyCorp/EasyAdminBundle/commit/6228dfef598d81eeb0baa35625e50812f3c77699"},{"type":"PACKAGE","url":"https://github.com/EasyCorp/EasyAdminBundle"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/easycorp/easyadmin-bundle/CVE-2026-81892.yaml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-11T03:30:54.606528717Z"}}