Lucene search
+L

1 matches found

Friends Of PHP
Friends Of PHP
added 2026/08/11 6:38 a.m.7 views

Custom action dispatcher bypasses access_control on other routes

Summary EasyAdmin serves all backend requests through a single dashboard route and, for custom actions Action::linkToRoute / MenuItem::linkToRoute, swaps the executed controller based on the routeName query parameter on the kernel.controller event. That swap happens after Symfony's security...

8.1CVSS5.9AI score0.0025EPSS
SaveExploits0Affected Software1
Rows per page
Query Builder