Symfony is a PHP framework for web and console applications, and a set of reusable PHP components. In earlier than versions 7.4.12 and 8.0.12, attributes such as #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] can be restricted to the GET HTTP method. However, Symfony routes HEAD requests to the same GET handler and deliberately skips the attribute checks, allowing requests to bypass authorization, CSRF validation, or signature verification. As a result, protected controller logic may execute, leaking response headers or performing unintended actions. This omission constitutes a method‑request mismatch (CWE‑863).

The vulnerability affects any Symfony application that uses the http-kernel, security-http, or core Symfony libraries with a version earlier than 7.4.12 or 8.0.12. Projects that protect routes by applying GET‑only attributes to controllers are susceptible until they upgrade to a patched release.

The CVSS score of 8.3 indicates a high severity impact. The EPSS score is below 1%, suggesting that public exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can exploit the flaw by sending a crafted HEAD request to any protected route, thereby bypassing security checks and triggering controller logic without authentication or special permissions.