EasyAdmin’s dispatcher swaps a custom action controller based on a query parameter after Symfony’s firewall has already evaluated access_control for the original dashboard URL. Because the injected routeName value is not validated, the security firewall never checks the new route’s path‑based access_control rule, allowing a low‑privilege backend user to execute a protected controller by simply knowing the target route name. The flaw fulfills CWE‑639 (privilege escalation through access control), CWE‑862 (missing authorization checks), and CWE‑863 (unchecked change of role before authorization). The impact is that an attacker can invoke arbitrary backend functionality beyond the intended permissions, potentially exposing data or modifying system state, while the user’s error handling remains unchanged.

EasyCorp’s EasyAdminBundle in all Symfony‑compatible versions from 4.0.0 up to and including 4.29.16 and 5.5.1 vulnerable to the dispatcher bypass. Users of these bundles who expose a custom‑action link that swaps the controller via the routeName parameter are affected.

The CVSS score of 8.1 indicates high severity, and the vulnerability is not indexed in CISA KEV, though its EPSS score is unavailable. An attacker would need web access to the EasyAdmin dashboard and knowledge of a target route name. Since the bypass only applies to path‑based access_control, routes protected by in‑controller checks (e.g., #[IsGranted]) remain safe. The attack path requires minimal reconnaissance and is achievable from any user with dashboard access, making the risk tangible for applications that rely solely on path‑based rules for backend protection.