{"action":"Upgrade symfony/twilio-notifier to 6.4.40 or later.","affected":[{"fixed":"6.4.40","introduced":"6.4.0"},{"fixed":"7.4.12","introduced":"7.0.0"},{"fixed":"8.0.12","introduced":"8.0.0"}],"component":"symfony/twilio-notifier","cve_ids":["CVE-2026-47212"],"ecosystem":"Packagist","epss":0.01506,"exploited":false,"fixed_versions":["6.4.40","7.4.12","8.0.12"],"ghsa_id":"GHSA-55rj-x2vc-4whq","id":"tcs_01M5KEVNBD2WNM8BAE7RYX9Q93","modified_at":"2026-09-10T03:51:04.682497296Z","published_at":"2026-05-29T21:32:23Z","references":["https://osv.dev/vulnerability/GHSA-55rj-x2vc-4whq","https://github.com/symfony/symfony/security/advisories/GHSA-55rj-x2vc-4whq","https://github.com/symfony/symfony/commit/8545fb2af6c07dfb5ef0fc8d9bccf86db2c94356","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-47212.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/twilio-notifier/CVE-2026-47212.yaml","https://github.com/symfony/symfony","https://symfony.com/cve-2026-47212"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-55rj-x2vc-4whq#Packagist/symfony/twilio-notifier","url":"https://osv.dev/vulnerability/GHSA-55rj-x2vc-4whq"}],"summary":"Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification"}