CVE-2026-81892

EasyAdmin, the popular admin generator bundle for Symfony, serves all backend requests through one dashboard route and swaps the executed controller based on an unvalidated routeName query parameter for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), but the swap happens after Symfony's firewall has already evaluated access_control rules against the original dashboard URL. A low-privilege authenticated backend user who can reach any single EasyAdmin URL and knows a target route's name can therefore invoke that route's controller, bypassing the path-based access_control rule that protects it. The attacker gains unauthorized execution of backend routes with high confidentiality and integrity impact (CVSS 3.1 8.1), though only path-based protections are bypassed — controllers enforcing their own checks via #[IsGranted] or denyAccessUnlessGranted() remain protected. All EasyAdmin releases from 4.0.0 before 4.29.16 and 5.x releases before 5.5.1 are affected. No public proof of concept is known and there are no reports of in-the-wild exploitation; EPSS is a low 0.3% (16th percentile).

What to do: Upgrade to EasyAdmin 4.29.16 (4.x) or 5.5.1 (5.x). Until upgraded, review which custom actions and menu items use linkToRoute(), and enforce authorization inside the target controllers with #[IsGranted] or denyAccessUnlessGranted() rather than relying solely on path-based access_control rules. Also check which low-privilege roles can reach the EasyAdmin dashboard and what backend route names are guessable or discoverable.