{"id":"CVE-2026-81892","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-81892","summary":"EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and,…","details":"EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.","published":"2026-08-31T20:38:06.196Z","modified":"2026-08-31T20:38:06.196Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/EasyCorp/EasyAdminBundle/commit/03be45c6b7213c4c984a1d0542b7ec60359329f8","label":"EasyCorp/EasyAdminBundle@03be45c"},"references":[{"type":"WEB","url":"https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-g2fm-8hr4-j82h"},{"type":"WEB","url":"https://github.com/EasyCorp/EasyAdminBundle/commit/03be45c6b7213c4c984a1d0542b7ec60359329f8"},{"type":"WEB","url":"https://github.com/EasyCorp/EasyAdminBundle/commit/6228dfef598d81eeb0baa35625e50812f3c77699"},{"type":"WEB","url":"https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v4.29.16"},{"type":"WEB","url":"https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.5.1"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-31T20:38:06.196Z"}}