Executive brief
A vulnerability in the Symfony web framework allows attackers to bypass security checks on certain web pages. By using a specific type of web request (HEAD), an attacker can trigger actions or view sensitive information that should normally be restricted to authorized users. This could lead to unauthorized data changes or the leakage of private information through web headers.
Technical details
A vulnerability exists in Symfony's handling of method-scoped security attributes including #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid]. When these attributes are configured to apply only to 'GET' requests, Symfony's router still routes 'HEAD' requests to the corresponding GET handler but fails to enforce the attribute's security constraints. An unauthenticated attacker can send a HEAD request to bypass authorization, CSRF, or signature checks. While the response body is not returned, the controller still executes, allowing for side effects (such as database writes) and the leakage of sensitive information via response headers. The issue is resolved in versions 7.4.12 and 8.0.12 by automatically including HEAD when GET is specified in the methods option.
Affected products
- symfony symfony >= 7.4.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12
- symfony http-kernel >= 7.4.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12
- symfony security-http >= 7.4.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12
Timeline
- 2026-05-20: patched: Fixes released in versions 7.4.12 and 8.0.12
- 2026-05-20: advisory: GitHub Security Advisory GHSA-6439-2f28-8p8q published
- 2026-07-14: disclosed: CVE-2026-45075 published to NVD