Description

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-31T21:17:52.927Z",
  "pubdate": "2026-08-31T21:17:52.927Z",
  "executiveSummary": "EasyAdmin is affected by an access control bypass vulnerability arising from improper request routing validation. The vulnerability stems from the application's reliance on the 'routeName' query parameter to dynamically swap controllers during the 'kernel.controller' event, occurring after Symfony's security firewall has completed its access_control evaluation.\nThis flaw allows low-privilege authenticated users to execute unauthorized backend controller actions. By manipulating the 'routeName' parameter, an attacker can bypass path-based security rules defined in the Symfony firewall. The risk is significant as it permits the execution of sensitive administrative logic that should be restricted based on URI paths.\nThe vulnerability affects EasyAdmin versions 4.0.0 through 4.29.15 and 5.0.0 through 5.5.0. Successful exploitation requires an authenticated user with access to the EasyAdmin dashboard who possesses knowledge of internal route names. While route-level authorization checks (e.g., #[IsGranted]) remain intact, path-based security configurations are rendered ineffective, leading to potential unauthorized data access or administrative action execution.",
  "technicalDetails": "The root cause of this vulnerability is a sequencing error in the Symfony kernel event lifecycle within EasyAdmin. EasyAdmin intercepts the 'kernel.controller' event to dynamically swap the executed controller based on the 'routeName' query parameter provided in the request URL. Because this controller substitution occurs after the Symfony 'security.firewall' has processed the 'access_control' rules for the initial dashboard request path, the firewall evaluates access against the generic dashboard route rather than the intended target controller.\nThe vulnerability manifests because the 'routeName' parameter is not validated against the application's routing map or current session privileges before the controller swap occurs. Since the security firewall has already determined the user is authorized to access the dashboard, the subsequent switch to a high-privilege or sensitive route happens in an 'authenticated' state, effectively bypassing any path-based 'access_control' restrictions that were meant to protect the target controller.\nThe attack flow proceeds as follows: First, an attacker authenticates as a low-privilege user with valid access to the primary EasyAdmin dashboard. Second, the attacker constructs a crafted request pointing to the dashboard route while appending the 'routeName' query parameter, set to the identifier of a target controller that would normally be restricted by an 'access_control' path rule. Third, the Symfony firewall grants access to the request because the base path is authorized. Finally, the EasyAdmin component intercepts the request during the 'kernel.controller' event, reads the malicious 'routeName', and swaps the execution context to the target controller, thereby executing restricted logic.\nNotably, this bypass is strictly limited to path-based protections. If the target controller utilizes attribute-based access control, such as '#[IsGranted]' or the 'denyAccessUnlessGranted()' method, these remain effective because they are evaluated during the controller execution phase after the swap has occurred. The impact is restricted to bypassing configurations that rely solely on security firewall paths. This vulnerability affects EasyAdmin versions 4.0.0 to 4.29.15 and 5.0.0 to 5.5.0. The flaw is resolved in versions 4.29.16 and 5.5.1 by implementing rigorous validation of the 'routeName' parameter prior to controller invocation."
}