Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81892— EasyAdmin custom-action dispatcher bypasses access_control on other routes

Quick assessment

Affected
EasyCorp EasyAdminBundle
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

EasyAdmin 是一个面向 Symfony 应用的快速、现代化管理后台生成器。从 4.0.0 到 4.29.16 和 5.5.1 版本中，EasyAdmin 通过单一的 dashboard 路由处理所有后端请求；对于自定义动作（Action::linkToRoute() 和 MenuItem::linkToRoute()），它会在 kernel.controller 事件中，根据 routeName 查询参数替换实际执行的控制器。该替换发生在 Symfony 安全防火墙已针对原始的 dashboard URL

CVSS 8.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81892

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
EasyAdmin custom-action dispatcher bypasses access_control on other routes
Source: CVE Program / CVE List V5
Vulnerability Description
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
EasyCorp EasyAdminBundle >= 4.0.0, < 4.29.16 -

II. Public POCs for CVE-2026-81892

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81892

请登录查看更多情报信息。

Other References for CVE-2026-81892 (5)

IV. Related Vulnerabilities

Same vendor: EasyCorp
Same weakness: CWE-639

V. Comments for CVE-2026-81892

No comments yet

Leave a comment