CVE-2026-81892

Name of the Vulnerable Software and Affected Versions EasyAdmin versions 4.0.0 through 4.29.15 EasyAdmin versions 5.x through 5.5.0

Description EasyAdmin serves backend requests through a single dashboard route. For custom actions using Action::linkToRoute() and MenuItem::linkToRoute(), the software swaps the executed controller based on the routeName query parameter during the kernel.controller event. Because this swap occurs after the security firewall has evaluated access control for the original dashboard URL and the routeName value is not validated, path-based access control rules for the target route are bypassed. This allows a low-privilege backend user to execute a target route's controller if they know the route name. Only path-based protections are affected; controllers that enforce authorization via #[IsGranted] or denyAccessUnlessGranted() remain protected.

Recommendations Update to version 4.29.16. Update to version 5.5.1.