Path-based Access Control Vulnerability in EasyAdmin for Symfony Applications
CVE-2026-81892
8.1HIGH
What is CVE-2026-81892?
The EasyAdmin framework for Symfony applications contains a vulnerability that allows low-privilege users to bypass certain path-based access controls. This occurs because the framework processes backend requests through a single dashboard route. Specifically, it allows attackers with knowledge of the intended route names to execute their controllers without proper access validation. Only path-based protections are affected, while controllers implementing their own authorization checks remain secure. The issue is resolved in versions 4.29.16 and 5.5.1, where enhanced route validation has been implemented.
Affected Version(s)
EasyAdminBundle >= 4.0.0, < 4.29.16 < 4.0.0, 4.29.16
EasyAdminBundle >= 5.0.0, < 5.5.1 < 5.0.0, 5.5.1