CVE-2026-81892: EasyAdmin Auth Bypass Vulnerability

CVE-2026-81892 Overview

CVE-2026-81892 is a broken access control vulnerability [CWE-639] in EasyAdmin, a Symfony admin panel generator. The flaw affects versions from 4.0.0 through 4.29.15 and 5.0.0 through 5.5.0. EasyAdmin routes all backend traffic through a single dashboard URL and swaps the executed controller based on the routeName query parameter during the kernel.controller event. Symfony's security firewall evaluates access_control rules against the original dashboard URL before the swap occurs. As a result, path-based access rules protecting target routes are never enforced, allowing low-privilege authenticated backend users to invoke controllers they should not reach.

Critical Impact
Authenticated low-privilege users can bypass path-based access_control rules and execute privileged controller actions by supplying a known route name via query parameter.

Affected Products

EasyCorp EasyAdminBundle 4.0.0 through 4.29.15
EasyCorp EasyAdminBundle 5.0.0 through 5.5.0
Symfony applications using Action::linkToRoute() or MenuItem::linkToRoute() with path-based access_control

Discovery Timeline

2026-08-31 - CVE-2026-81892 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-81892

Vulnerability Analysis

EasyAdmin uses a single dashboard controller route as the entry point for all backend requests. When a request specifies a routeName query parameter tied to a custom action registered via Action::linkToRoute() or MenuItem::linkToRoute(), the AdminRouterSubscriber swaps the executed controller during the kernel.controller event. This swap happens after Symfony's security firewall has already evaluated access_control rules against the original dashboard URL. The firewall never sees the target route path, so any path-based rule protecting that route is silently skipped.

Root Cause

The root cause is a classic authorization ordering flaw. Symfony's access_control rules match on request paths, but EasyAdmin rewrites the effective controller after path-based checks complete. The routeName parameter was also not validated against the current user's permissions. Routes that enforce authorization inside the controller via #[IsGranted] or denyAccessUnlessGranted() remain protected, since those checks run against the swapped-in controller. Only path-scoped rules are affected.

Attack Vector

An authenticated low-privilege backend user who can reach any EasyAdmin dashboard URL and knows a protected route's name can trigger execution of that route's controller. The attacker appends the target route name as a query parameter to the dashboard URL and issues a normal HTTP request. No special tooling is required.

php

// Patch excerpt from src/EventListener/AdminRouterSubscriber.php
// Adds security services to re-evaluate access_control after controller swap
use Symfony\Component\HttpKernel\Event\RequestEvent;
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
use Symfony\Component\Routing\Matcher\RequestMatcherInterface;
use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
use Symfony\Component\Security\Core\Authorization\Voter\AuthenticatedVoter;
use Symfony\Component\Security\Core\Exception\AccessDeniedException;
use Symfony\Component\Security\Http\AccessMapInterface;

/**
 * This subscriber acts as a "proxy" of all backend requests. First, if the
 * ...
 */

Source: GitHub commit 03be45c

Detection Methods for CVE-2026-81892

Indicators of Compromise

Dashboard requests carrying a routeName query parameter that resolves to a route the requesting user's role should not access under configured access_control rules.
Application logs showing successful controller execution for privileged routes from user sessions lacking the corresponding role.
Repeated enumeration-style requests to /admin (or the configured dashboard path) varying only in the routeName value.

Detection Strategies

Compare user role assignments against controllers executed during backend sessions and alert on mismatches with path-based access_control rules.
Instrument Symfony's kernel.controller event to log the pre-swap and post-swap controller pairs, then flag divergences that skip authorization voters.
Review web access logs for unexpected routeName values, particularly those referencing sensitive administrative routes.

Monitoring Recommendations

Ingest Symfony application and security logs into a central analytics platform and correlate routeName values with authenticated user roles.
Monitor for privilege-relevant actions such as user creation, role changes, and data export requests executed via the EasyAdmin dashboard endpoint.
Track EasyAdmin bundle versions across environments to identify hosts still running vulnerable releases.

How to Mitigate CVE-2026-81892

Immediate Actions Required

Upgrade EasyAdminBundle to 4.29.16 (for the 4.x branch) or 5.5.1 (for the 5.x branch) without delay.
Audit all custom actions using Action::linkToRoute() and MenuItem::linkToRoute() and verify each target controller enforces its own authorization.
Review current Symfony access_control configuration and confirm sensitive routes are not relying solely on path-based protections.

Patch Information

The fix is delivered in EasyAdminBundle v4.29.16 and EasyAdminBundle v5.5.1. Both releases inject security.access_map and security.authorization_checker into AdminRouterSubscriber and re-evaluate access_control against the swapped-in controller's route. Details are documented in GitHub Security Advisory GHSA-g2fm-8hr4-j82h.

Workarounds

Add #[IsGranted] attributes or denyAccessUnlessGranted() calls inside every controller reachable via linkToRoute(), since controller-enforced checks are recomputed after the swap and remain effective.
Restrict backend access at the network or reverse-proxy layer to limit which users can reach the EasyAdmin dashboard route.
Remove or disable custom actions registered via Action::linkToRoute() and MenuItem::linkToRoute() until upgrading is possible.

bash

# Upgrade EasyAdminBundle to a patched release using Composer
composer require easycorp/easyadmin-bundle:^4.29.16
# or, for the 5.x branch
composer require easycorp/easyadmin-bundle:^5.5.1

# Verify installed version
composer show easycorp/easyadmin-bundle | grep versions