Executive brief
EasyAdminBundle is a popular Symfony library used to rapidly build administrative dashboards. The custom-action dispatcher in versions 4.0.0–4.29.15 and 5.0.0–5.5.0 fails to re-validate path-based access controls when routing requests to target controllers, allowing low-privileged backend users to bypass authorization rules and access restricted administrative functions by specifying target route names.
Technical details
EasyAdminBundle implements custom actions via Action::linkToRoute() and MenuItem::linkToRoute() by swapping the controller to be executed based on the routeName query parameter, evaluated in the kernel.controller event. The vulnerability exists because this controller swap happens after Symfony's security firewall has already performed access_control checks against the original dashboard URL. Since the routeName parameter is not validated and the target route's path-based access_control rules are never re-evaluated, an attacker with access to the EasyAdmin dashboard can craft a request to an arbitrary protected route's controller, provided they know the route name. This allows privilege escalation for users with low-level backend access. The attack requires: (1) network access to the EasyAdmin dashboard, (2) low-privilege backend user credentials or session, and (3) knowledge of the target route's name. Routes protected via controller-level authorization (#[IsGranted] or denyAccessUnlessGranted()) remain safe because those checks are recomputed against the swapped-in controller. Patches in 4.29.16 and 5.5.1 re-evaluate the target route's access_control rule before dispatching.
Affected products
- EasyCorp EasyAdminBundle 4.0.0–4.29.15, 5.0.0–5.5.0
Timeline
- 2026-08-11: disclosed
- 2026-09-02: advisory
- 2026-09-02: patched: Fixed in versions 4.29.16 and 5.5.1