Easyadminbundle
Monthly
Controller swapping via the unvalidated `routeName` query parameter in EasyAdminBundle (versions 4.0.0 through 4.29.15 and 5.0.0 through 5.5.0) allows any authenticated low-privilege backend user to reach Symfony routes protected solely by path-based `access_control` rules, potentially exposing restricted administrative functionality without the appropriate role. An attacker who holds any EasyAdmin backend credential and knows a target route name can append `?routeName=target_route` to the admin dashboard URL, causing EasyAdmin's `AdminRouterSubscriber` to swap in the target controller after Symfony's firewall has already cleared the original URL - silently skipping the path rule guarding that route. Vendor-released patches exist in v4.29.16 and v5.5.1; no public exploit has been identified at time of analysis.
Controller swapping via the unvalidated `routeName` query parameter in EasyAdminBundle (versions 4.0.0 through 4.29.15 and 5.0.0 through 5.5.0) allows any authenticated low-privilege backend user to reach Symfony routes protected solely by path-based `access_control` rules, potentially exposing restricted administrative functionality without the appropriate role. An attacker who holds any EasyAdmin backend credential and knows a target route name can append `?routeName=target_route` to the admin dashboard URL, causing EasyAdmin's `AdminRouterSubscriber` to swap in the target controller after Symfony's firewall has already cleared the original URL - silently skipping the path rule guarding that route. Vendor-released patches exist in v4.29.16 and v5.5.1; no public exploit has been identified at time of analysis.