CVE-2026-45075

Katalog CVE

CVSS 8.2 · High EPSS 0,43%

Kerentanan Incorrect Authorization pada sensiolabs symfony. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

16 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/symfony/symfony/security/advisories/GHSA-6439-2f28-8p8q patch · advisory vendor
• https://github.com/symfony/symfony/releases/tag/v7.4.12 product · release notes
• https://github.com/symfony/symfony/releases/tag/v8.0.12 product · release notes