---
id: CVE-2026-81892
title: EasyAdmin is a fast and modern admin generator for Symfony applications
summary: >-
  EasyAdmin is a fast and modern admin generator for Symfony applications. From
  4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a
  single dashboard route and, for custom actions (Action::linkToRoute() and
  MenuIt…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-639
  - CWE-862
  - CWE-863
vendor: easycorp
product: easycorp/easyadmin-bundle
affected:
  - 'easycorp/easyadmin-bundle >= 4.0.0, < 4.29.16'
  - 'easycorp/easyadmin-bundle >= 5.0.0, < 5.5.1'
patched:
  - easycorp/easyadmin-bundle 4.29.16
  - easycorp/easyadmin-bundle 5.5.1
published: '2026-08-31'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81892'
references:
  - url: >-
      https://github.com/EasyCorp/EasyAdminBundle/commit/03be45c6b7213c4c984a1d0542b7ec60359329f8
    label: security-advisories@github.com
  - url: >-
      https://github.com/EasyCorp/EasyAdminBundle/commit/6228dfef598d81eeb0baa35625e50812f3c77699
    label: security-advisories@github.com
  - url: 'https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v4.29.16'
    label: security-advisories@github.com
  - url: 'https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.5.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-g2fm-8hr4-j82h
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81892'
  - url: >-
      https://github.com/FriendsOfPHP/security-advisories/blob/master/easycorp/easyadmin-bundle/CVE-2026-81892.yaml
  - url: 'https://github.com/advisories/GHSA-g2fm-8hr4-j82h'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00448
epssPercentile: 0.3629
aliases:
  - GHSA-g2fm-8hr4-j82h
ecosystem: composer
ingestedAt: '2026-09-02T14:45:29.842Z'
---

## Overview

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-81892)

Affected packages:

- `easycorp/easyadmin-bundle >= 4.0.0, < 4.29.16`
- `easycorp/easyadmin-bundle >= 5.0.0, < 5.5.1`

Patched in:

- `easycorp/easyadmin-bundle 4.29.16`
- `easycorp/easyadmin-bundle 5.5.1`

Source: https://github.com/advisories/GHSA-g2fm-8hr4-j82h