EUVD-2026-68802
GHSA-g2fm-8hr4-j82h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network delivery requiring a low-privilege backend account (PR:L); AC:L because only a known route name is needed; S:U and A:N as the bypass stays within the application and has no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.
AnalysisAI
Controller swapping via the unvalidated routeName query parameter in EasyAdminBundle (versions 4.0.0 through 4.29.15 and 5.0.0 through 5.5.0) allows any authenticated low-privilege backend user to reach Symfony routes protected solely by path-based access_control rules, potentially exposing restricted administrative functionality without the appropriate role. An attacker who holds any EasyAdmin backend credential and knows a target route name can append ?routeName=target_route to the admin dashboard URL, causing EasyAdmin's AdminRouterSubscriber to swap in the target controller after Symfony's firewall has already cleared the original URL - silently skipping the path rule guarding that route. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an existing EasyAdmin backend user account with any role sufficient to access the EasyAdmin dashboard URL (typically ROLE_USER or an equivalent low-privilege role). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 High rating (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects the impact when prerequisites are met: a low-complexity network exploit requiring no user interaction, with high confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade EasyAdminBundle to version 4.29.16 (https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v4.29.16) or version 5.5.1 (https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.5.1) depending on the installed branch; these are the vendor-confirmed fixed versions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit deployment configurations to identify which EasyAdminBundle versions are active (check composer.lock for 4.x or 5.x branches). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today