CVE-2026-81892 EasyAdmin custom-action dispatcher bypasses access_control on other routes
Low-privilege users can bypass path-based access controls to execute arbitrary backend routes by manipulating the routeName parameter in EasyAdmin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-81892?
CVE-2026-81892 is a high-severity missing authorization vulnerability in EasyCorp EasyAdminBundle, published on 31 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.
Which versions are affected by CVE-2026-81892?
4 open source packages ship an affected version, including easycorp/easyadmin-bundle.
| Package | Affected | Fixed in |
|---|---|---|
easycorp/easyadmin-bundle Packagist | From 4.0.0 | 4.29.16 |
easycorp/easyadmin-bundle Packagist | From 4.0.0 | 4.29.16 |
easycorp/easyadmin-bundle Packagist | From 5.0.0 | 5.5.1 |
easycorp/easyadmin-bundle Packagist | From 5.0.0 | 5.5.1 |
How do I fix CVE-2026-81892?
Upgrade easycorp/easyadmin-bundle to a fixed version for your release line: 4.29.16 or 5.5.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-81892 being exploited?
There is no known exploitation of CVE-2026-81892 in the wild and no public exploit code.
Sources
Also known as GHSA-g2fm-8hr4-j82h.