Answer in brief
CVE-2026-81892 records a High severity (CVSS 8.1) vulnerability in EasyAdmin custom-action dispatcher bypasses access_control on other routes. The current sources do not mark it as known exploited. The current feed maps easycorp/easyadmin-bundle (composer), easycorp/easyadmin-bundle (composer), EasyCorp/EasyAdminBundle (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps easycorp/easyadmin-bundle (composer), easycorp/easyadmin-bundle (composer), EasyCorp/EasyAdminBundle (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| easycorp/easyadmin-bundlecomposer | >=4.0.0,<4.29.16 | 4.29.16 |
| easycorp/easyadmin-bundlecomposer | >=5.0.0,<5.5.1 | 5.5.1 |
| EasyCorp/EasyAdminBundlegeneric | >= 4.0.0, < 4.29.16 || >= 5.0.0, < 5.5.1 | Not reported |
Published upstream
Aug 31, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 31, 2026
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.
Quoted source text, attributed separately from HOL analysis.