Authorization Bypass Through User-Controlled Key Affecting easycorp/easyadmin-bundle package, versions >=4.0.0, <4.29.16>=5.0.0, <5.5.1

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the AdminRouterSubscriber in src/EventListener/AdminRouterSubscriber.php. An attacker can reach a more restricted Symfony route by sending a backend request with ?routeName=... that makes EasyAdmin swap in the target controller after the firewall has already evaluated access_control against the original admin URL. This lets a low-privilege backend user invoke a route that should be limited by path-based security rules, exposing protected controller responses and any sensitive functionality behind them.

Workarounds

• Add controller-level authorization such as #[IsGranted] or denyAccessUnlessGranted() to sensitive routes, so access is enforced even if the route is reached through EasyAdmin’s ?routeName= dispatch.

• GitHub Commit v4.29.16
• GitHub Commit v5.5.1
• Maintainer's Advisory