EasyAdmin custom-action dispatcher bypasses access_control on other routes

Summary

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.

Timeline

1. Aug 31, 2026, 8:38 PM UTCCVE published
2. Sep 3, 2026, 5:59 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Sep 3, 2026, 5:59 PM UTCRecord last updated

Affected versions

• EasyCorp EasyAdminBundle

  From 4.0.0 · fixed in 4.29.16; From 5.0.0 · fixed in 5.5.1

• easycorp/easyadmin-bundlePackagist

  From 4.0.0 · fixed in 4.29.16

• easycorp/easyadmin-bundlePackagist

  From 5.0.0 · fixed in 5.5.1

References 5