CVE-2026-45075
published 2026-07-14CVE-2026-45075: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted]…
PriorityP351high8.2CVSS 3.1
AVNACLPRNUINSUCLIHAN
EPSS
0.38%
30.6th percentile
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sensiolabs | symfony | >= 7.4.0 < 7.4.12 | 7.4.12 |
| sensiolabs | symfony | >= 8.0.0 < 8.0.12 | 8.0.12 |
| symfony | http-kernel | — | — |
| symfony | http-kernel | — | — |
| symfony | http-kernel | >= 7.4.0 < 7.4.12 | 7.4.12 |
| symfony | http-kernel | >= 8.0.0 < 8.0.12 | 8.0.12 |
| symfony | security-http | — | — |
| symfony | security-http | — | — |
| symfony | security-http | >= 7.4.0 < 7.4.12 | 7.4.12 |
| symfony | security-http | >= 8.0.0 < 8.0.12 | 8.0.12 |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | >= 7.4.0 < 7.4.12 | 7.4.12 |
| symfony | symfony | >= 8.0.0 < 8.0.12 | 8.0.12 |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
nvdv4.08.3HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Synfony HEAD Request cross-site request forgery
vuldb·2026-05-28
CVE-2026-45075 [LOW] Synfony HEAD Request cross-site request forgery
A vulnerability labeled as problematic has been found in Synfony. This vulnerability affects unknown code of the component HEAD Request Handler. Such manipulation leads to cross-site request forgery.
This vulnerability is listed as CVE-2026-45075. The attack may be performed from remote. There is no available exploit.
The affected component should be upgraded.
GHSA
Synfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
ghsa·2026-05-27
CVE-2026-45075 [MEDIUM] CWE-863 Synfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
Synfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
### Description
Symfony's `#[IsGranted('...')]`, `#[IsSignatureValid]`, and `#[IsCsrfTokenValid(...)]` attributes allow you to define a `methods: [...]` argument to only enforce these checks for the listed HTTP methods and skip them otherwise. E.g. an attribute defining `methods: ['GET']` would be ignored for a `HEAD` request.
On the other hand, Symfony's router (and HTTP semantics generally) serves `HEAD` requests using the `GET` handler. Therefore, a controller protected by e.g. `#[IsGranted('ROLE_ADMIN', methods: ['GET'])]` can be reached via `HEAD` with the authorization check silently skipped.
Even if the `HEAD` request won't get any response content, response header
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-14
Published