{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-81892/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["TungNGo02"],"_cs_cpes":["cpe:2.3:a:easycorp:easyadmin-bundle:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-81892"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["EasyAdminBundle (\u003c 4.29.16)","EasyAdminBundle (5.0.0 - 5.5.0)"],"_cs_severities":["high"],"_cs_tags":["web-application","security-bypass","cve-2026-81892"],"_cs_type":"threat","_cs_vendors":["EasyCorp"],"content_html":"\u003cp\u003eEasyAdminBundle (CVE-2026-81892) contains a critical access control bypass vulnerability affecting versions 4.x before 4.29.16 and 5.x before 5.5.1. The issue resides in the custom-action dispatcher, which handles navigation via \u003ccode\u003eAction::linkToRoute()\u003c/code\u003e or \u003ccode\u003eMenuItem::linkToRoute()\u003c/code\u003e. When a user provides a \u003ccode\u003erouteName\u003c/code\u003e query parameter, EasyAdmin performs a controller swap on the \u003ccode\u003ekernel.controller\u003c/code\u003e event.\u003c/p\u003e\n\u003cp\u003eCrucially, this swap occurs after the Symfony security firewall has already evaluated \u003ccode\u003eaccess_control\u003c/code\u003e against the primary dashboard URL. Because the provided \u003ccode\u003erouteName\u003c/code\u003e is not re-validated against path-based firewall rules, an attacker can access restricted routes that rely solely on \u003ccode\u003esecurity.yaml\u003c/code\u003e definitions for protection. This bypass is limited to path-based access controls; routes that utilize controller-level authorization such as \u003ccode\u003e#[IsGranted]\u003c/code\u003e or \u003ccode\u003edenyAccessUnlessGranted()\u003c/code\u003e are not affected, as those checks are re-evaluated against the new controller. The vulnerability allows unauthorized users to interact with sensitive administrative functionality if they can identify the target route name.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows low-privileged users to access sensitive administrative routes protected only by path-based firewall configurations. If an application's security architecture relies on \u003ccode\u003eaccess_control\u003c/code\u003e rules to segment backend capabilities, an attacker can bypass these restrictions to gain unauthorized access to data or perform administrative functions. Routes that do not explicitly implement controller-level security checks are at high risk of exposure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade EasyAdminBundle to version 4.29.16 or 5.5.1 immediately to incorporate the required re-evaluation of \u003ccode\u003eaccess_control\u003c/code\u003e rules during custom-action dispatch.\u003c/li\u003e\n\u003cli\u003eAudit all sensitive routes to ensure they implement controller-level security using \u003ccode\u003e#[IsGranted]\u003c/code\u003e or \u003ccode\u003edenyAccessUnlessGranted()\u003c/code\u003e as a secondary defense-in-depth measure.\u003c/li\u003e\n\u003cli\u003eMonitor web application logs for unexpected access to admin-related controller paths that are typically hidden from low-privileged users.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-02T18:04:16Z","date_published":"2026-09-02T18:04:16Z","id":"https://feed.craftedsignal.io/briefs/2026-09-easyadmin-access-bypass/","summary":"EasyAdminBundle fails to re-validate Symfony access control rules when swapping controllers for custom actions, allowing low-privilege users to bypass path-based security and access restricted routes.","title":"EasyAdminBundle Access Control Bypass via Route Name Manipulation","url":"https://feed.craftedsignal.io/briefs/2026-09-easyadmin-access-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-81892","version":"https://jsonfeed.org/version/1.1"}