CVE-2026-81892: EasyCorp EasyAdminBundle authorization bypass in custom-action dispatcher

CVE-2026-81892 · Severity: high · CVSS 8.1 · Published 2026-08-31

EasyAdminBundle is a popular Symfony library used to rapidly build administrative dashboards. The custom-action dispatcher in versions 4.0.0–4.29.15 and 5.0.0–5.5.0 fails to re-validate path-based access controls when routing requests to target controllers, allowing low-privileged backend users to bypass authorization rules and access restricted administrative functions by specifying target route names.

Technologies: EasyCorp EasyAdminBundle. Vendors: EasyCorp, Packagist.

Quick answers

Is CVE-2026-81892 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-81892 being exploited in the wild.
How severe is CVE-2026-81892?
High severity, with a CVSS score of 8.1, published 31 August 2026.
Which products and versions are affected?
EasyCorp EasyAdminBundle 4.0.0–4.29.15, 5.0.0–5.5.0; easycorp/easyadmin-bundle (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.29.16.
Is there a fix for CVE-2026-81892?
Yes. easycorp/easyadmin-bundle (Packagist): upgrade to 4.29.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81892 attacked?
It is attacked over the network.
Am I affected by CVE-2026-81892?
Check whether you run EasyCorp EasyAdminBundle or easycorp/easyadmin-bundle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • easycorp/easyadmin-bundle (Packagist): upgrade to 4.29.16 or later
    composer require easycorp/easyadmin-bundle:^4.29.16

Technical details

EasyAdminBundle implements custom actions via Action::linkToRoute() and MenuItem::linkToRoute() by swapping the controller to be executed based on the routeName query parameter, evaluated in the kernel.controller event. The vulnerability exists because this controller swap happens after Symfony's security firewall has already performed access_control checks against the original dashboard URL. Since the routeName parameter is not validated and the target route's path-based access_control rules are never re-evaluated, an attacker with access to the EasyAdmin dashboard can craft a request to an arbitrary protected route's controller, provided they know the route name. This allows privilege escalation for users with low-level backend access. The attack requires: (1) network access to the EasyAdmin dashboard, (2) low-privilege backend user credentials or session, and (3) knowledge of the target route's name. Routes protected via controller-level authorization (#[IsGranted] or denyAccessUnlessGranted()) remain safe because those checks are recomputed against the swapped-in controller. Patches in 4.29.16 and 5.5.1 re-evaluate the target route's access_control rule before dispatching.

Affected products

  • EasyCorp EasyAdminBundle 4.0.0–4.29.15, 5.0.0–5.5.0

Identifiers

  • CVE-2026-81892
  • GHSA-g2fm-8hr4-j82h

Timeline

  • 2026-08-11: disclosed
  • 2026-09-02: advisory
  • 2026-09-02: patched: Fixed in versions 4.29.16 and 5.5.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.