CVE-2026-81892
1 advisory.
Packagist/easycorp/easyadmin-bundle CVE-2026-81892: high 8.1, EPSS 0.45%
EasyAdmin custom-action dispatcher bypasses access_control on other routes
Action: Upgrade easycorp/easyadmin-bundle to 4.29.16 or later.
composer require easycorp/easyadmin-bundle:4.29.16composer require easycorp/easyadmin-bundle:5.5.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.29.16 | - |
| 5.0.0 | 5.5.1 | - |
Fixed versions
| 4.29.16 | 5.5.1 |
Sources
- osv: GHSA-g2fm-8hr4-j82h
- https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-g2fm-8hr4-j82h
- https://nvd.nist.gov/vuln/detail/CVE-2026-81892
- https://github.com/EasyCorp/EasyAdminBundle/commit/03be45c6b7213c4c984a1d0542b7ec60359329f8
- https://github.com/EasyCorp/EasyAdminBundle/commit/6228dfef598d81eeb0baa35625e50812f3c77699
- https://github.com/EasyCorp/EasyAdminBundle
- https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v4.29.16
- https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.5.1
- https://github.com/FriendsOfPHP/security-advisories/blob/master/easycorp/easyadmin-bundle/CVE-2026-81892.yaml
CVE-2026-81892 · published · modified · JSON