Privilege Escalation in EasyAdmin Symfony Admin Panel

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-81892

Affected Vendors & Products

Vendor	Product	Version / Range
easycorp	easyadmin	From 4.0.0 (inc) to 4.29.16 (inc)
easycorp	easyadmin	5.5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in EasyAdmin allows low-privilege users to bypass path-based access control rules by exploiting a route swapping mechanism. The issue occurs because the system swaps controllers based on a routeName parameter after security checks are performed, allowing unauthorized access to protected routes if the route name is known.

Impact Analysis

An attacker with low privileges could access restricted admin functionality by knowing a target route's name, potentially leading to unauthorized actions like data manipulation or system changes. This bypasses intended security controls, increasing risk of data breaches or system compromise.

Mitigation Strategies

Upgrade EasyAdmin to version 4.29.16 or 5.5.1 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-81892. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70