Executive brief
A vulnerability in the Symfony web framework allows attackers to send fake notifications or email status updates to applications using Mailjet or LOX24. The software failed to check security credentials for incoming webhooks, meaning an unauthorized person could trigger actions in your system by pretending to be a trusted service. This could lead to incorrect data being processed or automated workflows being triggered by fraudulent information.
Technical details
A missing authentication check (CWE-306) exists in Symfony's Mailjet and LOX24 bridge components. The webhook parsers for these services received configured secrets but failed to perform verification against incoming POST requests. An unauthenticated remote attacker can exploit this by sending forged HTTP POST payloads to the webhook endpoint, potentially triggering application logic associated with email delivery events or notification statuses. The issue is resolved by enforcing Basic credential verification for Mailjet and token verification for LOX24 in versions 6.4.40, 7.4.12, and 8.0.12.
Affected products
- Symfony symfony/symfony >= 6.4.0, < 6.4.40; >= 7.0.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12
- Symfony lox24-notifier >= 7.1.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12
- Symfony mailjet-mailer >= 6.4.0, < 6.4.40; >= 7.0.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory
- 2026-05-20: patched: Release date of fixed versions 6.4.40, 7.4.12, and 8.0.12
References
- https://github.com/symfony/symfony/commit/3e52bf5ab733ee32e35eeeeb2631d859c941838e
- https://github.com/symfony/symfony/commit/4aaa45dd054f73445f1ab254968b7e60b546cc77
- https://github.com/symfony/symfony/releases/tag/v6.4.40
- https://github.com/symfony/symfony/releases/tag/v7.4.12
- https://github.com/symfony/symfony/releases/tag/v8.0.12
- https://github.com/symfony/symfony/security/advisories/GHSA-64hg-93w9-fc35