{"id":"CVE-2026-81892","title":"EasyAdmin is a fast and modern admin generator for Symfony applications","summary":"EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuIt…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-639","CWE-862","CWE-863"],"vendor":"easycorp","product":"easycorp/easyadmin-bundle","affected":["easycorp/easyadmin-bundle >= 4.0.0, < 4.29.16","easycorp/easyadmin-bundle >= 5.0.0, < 5.5.1"],"patched":["easycorp/easyadmin-bundle 4.29.16","easycorp/easyadmin-bundle 5.5.1"],"published":"2026-08-31","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81892","references":[{"url":"https://github.com/EasyCorp/EasyAdminBundle/commit/03be45c6b7213c4c984a1d0542b7ec60359329f8","label":"security-advisories@github.com"},{"url":"https://github.com/EasyCorp/EasyAdminBundle/commit/6228dfef598d81eeb0baa35625e50812f3c77699","label":"security-advisories@github.com"},{"url":"https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v4.29.16","label":"security-advisories@github.com"},{"url":"https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.5.1","label":"security-advisories@github.com"},{"url":"https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-g2fm-8hr4-j82h","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81892"},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/easycorp/easyadmin-bundle/CVE-2026-81892.yaml"},{"url":"https://github.com/advisories/GHSA-g2fm-8hr4-j82h"}],"tags":["nvd","ghsa","composer"],"epss":0.0025,"epssPercentile":0.1672,"aliases":["GHSA-g2fm-8hr4-j82h"],"ecosystem":"composer","ingestedAt":"2026-09-02T14:45:29.842Z","slug":"CVE-2026-81892","body":"## Overview\n\nEasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-81892)\n\nAffected packages:\n\n- `easycorp/easyadmin-bundle >= 4.0.0, < 4.29.16`\n- `easycorp/easyadmin-bundle >= 5.0.0, < 5.5.1`\n\nPatched in:\n\n- `easycorp/easyadmin-bundle 4.29.16`\n- `easycorp/easyadmin-bundle 5.5.1`\n\nSource: https://github.com/advisories/GHSA-g2fm-8hr4-j82h","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}