CVE-2026-81892: CWE-639: Authorization Bypass Through User-Controlled Key in EasyCorp EasyAdminBundle

EasyAdminBundle versions prior to 4.29.16 and 5.5.1 serve backend requests through a single dashboard route and allow custom actions to swap the executed controller based on the routeName query parameter during the kernel.controller event. Since this swap happens after Symfony's security firewall has evaluated access control against the original dashboard URL, path-based access control rules for the target route are not enforced. This allows a low-privilege backend user who can access the EasyAdmin URL and knows a target route's name to execute that route's controller, bypassing path-based access control. Routes with explicit authorization annotations or checks remain protected. The vulnerability is identified as CWE-639 (Authorization Bypass Through User-Controlled Key) and related CWEs 862 and 863. The CVSS v3.1 score is 8.1 (high severity).

An attacker with low-privilege backend access can bypass path-based access control rules by manipulating the routeName parameter to execute controllers of routes they should not have access to. This results in unauthorized disclosure and modification of data (high confidentiality and integrity impact). However, routes enforcing their own authorization checks remain protected. There is no impact on availability. No known exploits in the wild have been reported.

Upgrade EasyAdminBundle to version 4.29.16 or 5.5.1 or later, where this issue is fixed. Until then, avoid relying solely on path-based access control rules for sensitive routes and ensure explicit authorization checks are implemented within controllers. Patch status is not explicitly stated in the vendor advisory, but the description confirms the issue is fixed in 4.29.16 and 5.5.1.