CVE-2026-45075: Symfony authorization bypass via HEAD requests in security attributes

CVE-2026-45075 · Severity: medium · CVSS 4 · Published 2026-07-14

A vulnerability in the Symfony web framework allows attackers to bypass security checks on certain web pages. By using a specific type of web request (HEAD), an attacker can trigger actions or view sensitive information that should normally be restricted to authorized users. This could lead to unauthorized data changes or the leakage of private information through web headers.

Technologies: symfony/http-kernel (Packagist), symfony/security-http (Packagist), symfony/symfony (Packagist), Symfony Security HTTP. Vendors: Packagist, Symfony.

Quick answers

Is CVE-2026-45075 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45075 being exploited in the wild.
How severe is CVE-2026-45075?
Medium severity, with a CVSS score of 4, published 14 July 2026.
Which products and versions are affected?
symfony/http-kernel (Packagist) ECOSYSTEM:introduced=7.4.0,fixed=7.4.12; symfony/security-http (Packagist) ECOSYSTEM:introduced=7.4.0,fixed=7.4.12; symfony/symfony (Packagist) ECOSYSTEM:introduced=7.4.0,fixed=7.4.12; Symfony HttpKernel >= 7.4.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12; and 1 more.
Is there a fix for CVE-2026-45075?
Yes. symfony/http-kernel (Packagist): upgrade to 7.4.12 or later; symfony/security-http (Packagist): upgrade to 7.4.12 or later; symfony/symfony (Packagist): upgrade to 7.4.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45075 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45075?
Check whether you run symfony/http-kernel (Packagist), symfony/security-http (Packagist), symfony/symfony (Packagist) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • symfony/http-kernel (Packagist): upgrade to 7.4.12 or later
    composer require symfony/http-kernel:^7.4.12
  • symfony/security-http (Packagist): upgrade to 7.4.12 or later
    composer require symfony/security-http:^7.4.12
  • symfony/symfony (Packagist): upgrade to 7.4.12 or later
    composer require symfony/symfony:^7.4.12

Technical details

A vulnerability exists in Symfony's handling of method-scoped security attributes including #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid]. When these attributes are configured to apply only to 'GET' requests, Symfony's router still routes 'HEAD' requests to the corresponding GET handler but fails to enforce the attribute's security constraints. An unauthenticated attacker can send a HEAD request to bypass authorization, CSRF, or signature checks. While the response body is not returned, the controller still executes, allowing for side effects (such as database writes) and the leakage of sensitive information via response headers. The issue is resolved in versions 7.4.12 and 8.0.12 by automatically including HEAD when GET is specified in the methods option.

Affected products

  • symfony symfony >= 7.4.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12
  • symfony http-kernel >= 7.4.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12
  • symfony security-http >= 7.4.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12

Identifiers

  • CVE-2026-45075
  • GHSA-6439-2f28-8p8q

Timeline

  • 2026-05-20: patched: Fixes released in versions 7.4.12 and 8.0.12
  • 2026-05-20: advisory: GitHub Security Advisory GHSA-6439-2f28-8p8q published
  • 2026-07-14: disclosed: CVE-2026-45075 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.