EasyAdmin custom-action dispatcher bypasses access_control on other routes

Summary EasyAdmin serves all backend requests through a single dashboard route and, for custom actions Action::linkToRoute / MenuItem::linkToRoute, swaps the executed controller based on the routeName query parameter on the kernel.controller event. That swap happens after Symfony's security...

EUVD-2026-68802

EasyAdmin custom-action dispatcher bypasses accesscontrol on other routes...

CVE-2026-81892

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions Action::linkToRoute and MenuItem::linkToRoute, swaps the executed controller based on the...

CVE-2026-81892

EasyAdmin for Symfony (versions 4.0.0 through 4.29.16 and 5.5.1) contains a security bypass in its custom-action dispatcher. When Action::linkToRoute() or MenuItem::linkToRoute() is used, the executed controller is swapped via the routeName query parameter on the kernel.controller event — after S...

CVE-2026-81892 EasyAdmin custom-action dispatcher bypasses access_control on other routes

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions Action::linkToRoute and MenuItem::linkToRoute, swaps the executed controller based on the...

PT-2026-84023

Name of the Vulnerable Software and Affected Versions EasyAdmin versions 4.0.0 through 4.29.15 EasyAdmin versions 5.x through 5.5.0 Description EasyAdmin serves backend requests through a single dashboard route. For custom actions using Action::linkToRoute and MenuItem::linkToRoute, the software...