{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "4.0.0"
              },
              {
                "fixed": "4.29.16"
              },
              {
                "introduced": "5.0.0"
              },
              {
                "fixed": "5.5.1"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "020d25ad84f1822688ca8313007f07e4f85e4508"
            },
            {
              "introduced": "e2134a0d1e90245790ac131276bb283077e40562"
            },
            {
              "fixed": "bd7e837db9392d46b1d13a4048cd1df6f69798e4"
            },
            {
              "fixed": "77b2a6b13c7050cd5412b3ce2b86e909682b97c3"
            },
            {
              "fixed": "03be45c6b7213c4c984a1d0542b7ec60359329f8"
            },
            {
              "fixed": "6228dfef598d81eeb0baa35625e50812f3c77699"
            }
          ],
          "repo": "https://github.com/easycorp/easyadminbundle",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-g2fm-8hr4-j82h"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-639",
      "CWE-862",
      "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81892.json"
  },
  "details": "EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.",
  "id": "CVE-2026-81892",
  "modified": "2026-09-05T03:30:57.866226674Z",
  "published": "2026-08-31T20:38:06.196Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v4.29.16"
    },
    {
      "type": "WEB",
      "url": "https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.5.1"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81892.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-g2fm-8hr4-j82h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81892"
    },
    {
      "type": "FIX",
      "url": "https://github.com/EasyCorp/EasyAdminBundle/commit/03be45c6b7213c4c984a1d0542b7ec60359329f8"
    },
    {
      "type": "FIX",
      "url": "https://github.com/EasyCorp/EasyAdminBundle/commit/6228dfef598d81eeb0baa35625e50812f3c77699"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "EasyAdmin custom-action dispatcher bypasses access_control on other routes"
}