AIKIDO-2026-56487

easycorp/easyadmin-bundle is vulnerable to Authorization Bypass

Authorization BypassGHSA-g2fm-8hr4-j82h Published Aug 12, 2026

High Risk

This Affects:

easycorp/easyadmin-bundle

4.0.0 - 4.29.15

Fixed in 4.29.16

5.0.0 - 5.5.0

Fixed in 5.5.1

Are you affected? Scan for Free

TL;DR

EasyAdmin serves backend requests through a single dashboard route and, for custom actions created with Action::linkToRoute() or MenuItem::linkToRoute(), swaps the executed controller from the routeName query parameter on the kernel.controller event after Symfony's firewall has already evaluated access_control against the dashboard URL. Because that routeName was not re-checked against the target route's path-based rules, a low-privilege backend user who can reach EasyAdmin and knows a restricted route name can execute that route's controller and bypass the path-based protection. Controller-level checks such as #[IsGranted] remain enforced. The fix re-evaluates the target route's access_control rule before dispatching a custom-action route.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and rely on path-based Symfony access_control rules to protect routes more strictly than the EasyAdmin dashboard URL, while using custom actions or menu items that link to those routes by name.