CVE-2026-81892: Easycorp/easyadmin bundle EasyAdmin Custom-action Dispatcher Bypasses Access_control Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-g2fm-8hr4-j82h",
  "modified" : "2026-09-02T14:39:11Z",
  "published" : "2026-09-02T14:39:11Z",
  "aliases" : [ "CVE-2026-81892" ],
  "summary" : "EasyAdmin custom-action dispatcher bypasses access_control on other routes",
  "details" : "## Summary\n\nEasyAdmin serves all backend requests through a single dashboard route and, for custom actions (`Action::linkToRoute()` / `MenuItem::linkToRoute()`), swaps the executed controller based on the `routeName` query parameter on the `kernel.controller` event.\n\nThat swap happens **after** Symfony's security firewall has already evaluated `access_control` against the original dashboard URL, and the `routeName` value was not validated. As a result, a path-based `access_control` rule protecting the *target* route was never evaluated, so a low-privilege backend user could reach a more restricted route by name.\n\n## Impact\n\nAny application where `access_control` (or another path-based Symfony security rule) protects some routes more strictly than the dashboard URL used to reach EasyAdmin. An attacker who can reach a single EasyAdmin URL and knows a target route's **name** can execute that route's controller, bypassing the path-based rule.\n\nOnly **path-based** protections are bypassed. Routes whose controller enforces its own authorization with `#[IsGranted]` / `denyAccessUnlessGranted()` remain protected, because those checks are recomputed against the swapped-in controller.\n\n## Patches\n\nFixed in **4.29.16** and **5.5.1**. Before dispatching a custom-action route, EasyAdmin now re-evaluates the target route's `access_control` rule and denies the request if the current user is not granted access.\n\n## Workarounds\n\nAdd controller-level authorization (`#[IsGranted]` / `denyAccessUnlessGranted()`) to any sensitive route, since controller-level checks are still enforced. Upgrading is the recommended fix.\n\n## Credits\n\nReported by @TungNGo02.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "easycorp/easyadmin-bundle"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.0"
      }, {
        "fixed" : "4.29.16"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "easycorp/easyadmin-bundle"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0"
      }, {
        "fixed" : "5.5.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-g2fm-8hr4-j82h"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-81892"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/EasyCorp/EasyAdminBundle/commit/03be45c6b7213c4c984a1d0542b7ec60359329f8"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/EasyCorp/EasyAdminBundle/commit/6228dfef598d81eeb0baa35625e50812f3c77699"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/EasyCorp/EasyAdminBundle"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v4.29.16"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.5.1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/easycorp/easyadmin-bundle/CVE-2026-81892.yaml"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-639", "CWE-862", "CWE-863" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-02T14:39:11Z",
    "nvd_published_at" : "2026-08-31T21:17:52Z"
  }
}