Http kernel: Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] (CVE-2026-45075)
### Description Symfony's `#[IsGranted('...')]`, `#[IsSignatureValid]`, and `#[IsCsrfTokenValid(...)]` attributes allow you to define a `methods: [...]` argument to only enforce these checks for the listed HTTP methods and skip them otherwise. E.g. an attribute defining `methods: ['GET']` would be ignored for a `HEAD` request. On the other hand, Symfony's router (and HTTP semantics generally) serves `HEAD` requests using the `GET` handler. Therefore, a controller protected by e.g. `#[IsGranted('ROLE_ADMIN', methods: ['GET'])]` can be reached via `HEAD` with the authorization check silently skipped. Even if the `HEAD` request won't get any response content, response headers leak (`Content-Length`, `Location`, custom headers). Also, the controller still executes and any side effects (DB writes, state changes) occur. ### Resolution When adding `GET` in the `methods` option of these attributes, Symfony now also include the `HEAD` method automatically. The patch for this issue is available [here](https://github.com/symfony/symfony/commit/fa8d5c67aa4b22c9656e3fd7d5c3aa59865bf838) for branch 7.4. ### Credits Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and Alexandre Daubois for fixing it.
AI Analysis
Technical Summary
The vulnerability arises because Symfony's #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes accept a methods argument to restrict enforcement to certain HTTP methods. When methods: ['GET'] is specified, HEAD requests bypass these security checks since HEAD requests are handled by the GET route but are not included in the methods list. This allows unauthorized execution of controller code and side effects on HEAD requests, despite no response body being returned. The patch fixes this by automatically including HEAD when GET is specified. The affected versions are >=7.4.0 <7.4.12 and >=8.0.0 <8.0.12.
Potential Impact
Authorization and validation checks can be bypassed on HEAD requests for controllers protected by these attributes with methods restricted to GET. This can lead to unauthorized execution of controller logic and side effects such as database writes or state changes. Although no response content is returned on HEAD requests, response headers may leak information. This bypass undermines intended access controls and can expose sensitive operations to unauthorized users.
Mitigation Recommendations
A patch is available and should be applied to upgrade Symfony to versions >=7.4.12 or >=8.0.12 where the issue is fixed. The patch automatically includes HEAD when GET is specified in the methods argument of the affected attributes. Until patched, avoid restricting methods to GET only or explicitly include HEAD in the methods list to ensure checks are enforced on HEAD requests.
Http kernel: Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] (CVE-2026-45075)
Description
### Description Symfony's `#[IsGranted('...')]`, `#[IsSignatureValid]`, and `#[IsCsrfTokenValid(...)]` attributes allow you to define a `methods: [...]` argument to only enforce these checks for the listed HTTP methods and skip them otherwise. E.g. an attribute defining `methods: ['GET']` would be ignored for a `HEAD` request. On the other hand, Symfony's router (and HTTP semantics generally) serves `HEAD` requests using the `GET` handler. Therefore, a controller protected by e.g. `#[IsGranted('ROLE_ADMIN', methods: ['GET'])]` can be reached via `HEAD` with the authorization check silently skipped. Even if the `HEAD` request won't get any response content, response headers leak (`Content-Length`, `Location`, custom headers). Also, the controller still executes and any side effects (DB writes, state changes) occur. ### Resolution When adding `GET` in the `methods` option of these attributes, Symfony now also include the `HEAD` method automatically. The patch for this issue is available [here](https://github.com/symfony/symfony/commit/fa8d5c67aa4b22c9656e3fd7d5c3aa59865bf838) for branch 7.4. ### Credits Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and Alexandre Daubois for fixing it.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises because Symfony's #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes accept a methods argument to restrict enforcement to certain HTTP methods. When methods: ['GET'] is specified, HEAD requests bypass these security checks since HEAD requests are handled by the GET route but are not included in the methods list. This allows unauthorized execution of controller code and side effects on HEAD requests, despite no response body being returned. The patch fixes this by automatically including HEAD when GET is specified. The affected versions are >=7.4.0 <7.4.12 and >=8.0.0 <8.0.12.
Potential Impact
Authorization and validation checks can be bypassed on HEAD requests for controllers protected by these attributes with methods restricted to GET. This can lead to unauthorized execution of controller logic and side effects such as database writes or state changes. Although no response content is returned on HEAD requests, response headers may leak information. This bypass undermines intended access controls and can expose sensitive operations to unauthorized users.
Mitigation Recommendations
A patch is available and should be applied to upgrade Symfony to versions >=7.4.12 or >=8.0.12 where the issue is fixed. The patch automatically includes HEAD when GET is specified in the methods argument of the affected attributes. Until patched, avoid restricting methods to GET only or explicitly include HEAD in the methods list to ensure checks are enforced on HEAD requests.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6439-2f28-8p8q
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-45075"]
- Ecosystems
- ["Packagist"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a46ecb027e9c7971943c497
Added to database: 07/02/2026, 22:56:48 UTC
Last enriched: 07/02/2026, 23:06:39 UTC
Last updated: 07/31/2026, 19:24:46 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.