EasyAdminBundle CVE-2026-81892

Exploitation requires an existing EasyAdmin backend user account with any role sufficient to access the EasyAdmin dashboard URL (typically ROLE_USER or an equivalent low-privilege role). The target route must be protected exclusively by Symfony's path-based access_control mechanism - for example, a pattern like '^/admin/secure': ROLE_ADMIN - and must not independently enforce authorization via PHP attributes such as #[IsGranted] or explicit denyAccessUnlessGranted() calls within the controller body; routes using those checks remain fully protected. The attacker must know or enumerate the Symfony internal route name of the target controller. Exploitation is constrained to EasyAdminBundle versions 4.0.0 through 4.29.15 and 5.0.0 through 5.5.0 on any platform where the bundle is deployed.

The CVSS 8.1 High rating (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects the impact when prerequisites are met: a low-complexity network exploit requiring no user interaction, with high confidentiality and integrity impact. Real-world risk is bounded by the prerequisite of an existing authenticated backend session - the attacker must already hold a low-privilege EasyAdmin account, confining exposure to insider threats, credential compromise, or applications that allow low-privilege self-registration. No EPSS score, CISA KEV listing, or public exploit code is present in the provided data, so no conclusion can be drawn about active exploitation; however, the attack requires only a single crafted HTTP GET request and no specialized tooling, making it trivially automatable the moment an attacker has credentials. Even a mid-sized municipal IT team in tczew running Symfony-based admin portals should treat this as an urgent internal patch given how quickly a compromised low-privilege account translates to full access over path-restricted routes. Organizations that rely exclusively on Symfony access_control path rules - rather than controller-level #[IsGranted] checks - face the highest exposure, as those controller-level guards are unaffected by the bypass and continue to enforce authorization correctly.

An attacker with a content-editor-level EasyAdmin account enumerates Symfony route names - feasible through application source review, debug toolbar leakage, or error messages - and identifies an ROLE_ADMIN-only route (e.g., admin_user_promote) protected solely by a Symfony access_control path rule. The attacker sends a single GET request to the admin dashboard URL appended with ?routeName=admin_user_promote; EasyAdmin's AdminRouterSubscriber swaps in the privileged controller after Symfony's firewall has already approved the dashboard URL, executing the restricted action under the attacker's low-privilege session with no further interaction required.