EasyAdmin custom-action dispatcher bypasses access_control on other routes
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.
Summary
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| EasyCorp | EasyAdminBundle | 4.0.0 to before 4.29.16; 5.0.0 to before 5.5.1 | 4.29.16, 5.5.1 | Patch available | CNA |
| — | easycorp/easyadmin-bundle (Packagist) | 4.0.0 to before 4.29.16 | 4.29.16 | Patch available | GHSA-g2fm-8hr4-j82h |
| — | easycorp/easyadmin-bundle (Packagist) | 5.0.0 to before 5.5.1 | 5.5.1 | Patch available | GHSA-g2fm-8hr4-j82h |
- EasyAdminBundle VendorEasyCorp Affected 4.0.0 to before 4.29.16; 5.0.0 to before 5.5.1 Fixed in 4.29.16, 5.5.1 Patch available CNA
- easycorp/easyadmin-bundle (Packagist) Vendor— Affected 4.0.0 to before 4.29.16 Fixed in 4.29.16 Patch available GHSA-g2fm-8hr4-j82h
- easycorp/easyadmin-bundle (Packagist) Vendor— Affected 5.0.0 to before 5.5.1 Fixed in 5.5.1 Patch available GHSA-g2fm-8hr4-j82h
Remediation
- Fix · CNA EasyAdminBundle (EasyCorp) Fixed in 4.29.16, 5.5.1
- Fix · GHSA-g2fm-8hr4-j82h easycorp/easyadmin-bundle (Packagist) Fixed in 4.29.16 Advisory →
- Fix · GHSA-g2fm-8hr4-j82h easycorp/easyadmin-bundle (Packagist) Fixed in 5.5.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-81892
- 2026-10-03 Alias added: GHSA-g2fm-8hr4-j82h
References
Other 7
- https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-g2fm-8hr4-j82h
- https://github.com/EasyCorp/EasyAdminBundle/commit/03be45c6b7213c4c984a1d0542b7ec60359329f8
- https://github.com/EasyCorp/EasyAdminBundle/commit/6228dfef598d81eeb0baa35625e50812f3c77699
- https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v4.29.16
- https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.5.1
- https://github.com/EasyCorp/EasyAdminBundle
- https://github.com/FriendsOfPHP/security-advisories/blob/master/easycorp/easyadmin-bundle/CVE-2026-81892.yaml
More EasyCorp vulnerabilities
- TI-2024-16042 Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE)… CVSS 3.1CRITICAL 9.8
- TI-2024-16039 An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community… CVSS 3.1CRITICAL 9.8
- TI-2023-24012 An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before… CVSS 3.1HIGH 8.8
- TI-2022-23694 ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. CVSS 3.1HIGH 8.8
- TI-2023-26980 Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly. CVSS 3.1MEDIUM 6.1
- TI-2020-14347 Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute… CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-81892 · CVE Program
- CVE-2026-81892 · NVD
- FIRST EPSS
- GHSA-g2fm-8hr4-j82h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences