CVE-2026-45755 Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
Attackers can inject forged email delivery events by bypassing HMAC signature verification in the Symfony Mailtrap Mailer webhook parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45755?
CVE-2026-45755 is a medium-severity missing authorization vulnerability in Sensiolabs Symfony, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse() received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged Mailtrap delivery, bounce, open, click, or spam events. This issue is fixed in versions 7.4.12 and 8.0.12.
Which versions are affected by CVE-2026-45755?
8 open source packages ship an affected version, including symfony/mailtrap-mailer and symfony/symfony. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
symfony/mailtrap-mailer Packagist | From 7.2.0 | 7.4.12 |
symfony/mailtrap-mailer Packagist | From 7.2.0 | 7.4.12 |
symfony/mailtrap-mailer Packagist | From 8.0.0 | 8.0.12 |
symfony/mailtrap-mailer Packagist | From 8.0.0 | 8.0.12 |
symfony/symfony Packagist | From 7.2.0 | 7.4.12 |
symfony/symfony Packagist | From 7.2.0 | 7.4.12 |
2 more packages
symfony/symfony Packagist | From 8.0.0 | 8.0.12 |
symfony/symfony Packagist | From 8.0.0 | 8.0.12 |
Products include Sensiolabs Symfony.
How do I fix CVE-2026-45755?
Upgrade symfony/mailtrap-mailer to a fixed version for your release line: 7.4.12 or 8.0.12.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-45755 being exploited?
There is no known exploitation of CVE-2026-45755 in the wild and no public exploit code.
Other vulnerabilities in Sensiolabs Symfony
Sources
Also known as DEBIAN-CVE-2026-45755, GHSA-59f3-vp2f-mp9w, UBUNTU-CVE-2026-45755.