Path-Based Authorization Bypass in Symfony Routing Components
CVE-2026-118516

6.3MEDIUM

Key Information:

Vendor

Sensiolabs

Status
Symfony
Vendor
CVE Published:
4 November 2026

What is CVE-2026-118516?

The Symfony Routing components are susceptible to a path-based authorization bypass due to inconsistent handling of host and path data. Versions prior to 5.4.56, 6.x before 6.4.50, 7.x before 7.4.23, and 8.x prior to 8.1.11 are affected. This vulnerability arises because the CompiledUrlMatcher and UrlMatcher treat host and path separately, paving the way for potential unauthorized access to protected resources. Specifically, routes defined with host placeholders may inadvertently allow unauthenticated requests to reach sensitive controllers, undermining the intended access control mechanisms. Developers utilizing affected Symfony versions should promptly review and apply recommended security patches to mitigate risks.

Affected Version(s)

symfony 0 < 5.4.56

symfony 6 < 6.4.50

symfony 7 < 7.4.23

References

https://github.com/symfony/symfony/security/advisories/GH...
third-party-advisory
https://github.com/symfony/symfony/commit/067cde51e29f6d6...
patch

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vincent Cassiau
Nicolas Grekas
.