AIKIDO-2026-56487

TL;DR

EasyAdmin serves backend requests through a single dashboard route and, for custom actions created with Action::linkToRoute() or MenuItem::linkToRoute(), swaps the executed controller from the routeName query parameter on the kernel.controller event after Symfony's firewall has already evaluated access_control against the dashboard URL. Because that routeName was not re-checked against the target route's path-based rules, a low-privilege backend user who can reach EasyAdmin and knows a restricted route name can execute that route's controller and bypass the path-based protection. Controller-level checks such as #[IsGranted] remain enforced. The fix re-evaluates the target route's access_control rule before dispatching a custom-action route.