CVE-2026-45075: Symfony HTTP Kernel Bypass of Authorization Checks via HEAD Requests
Summary
CVE-2026-45075: Description Symfony's #[IsGranted('...')], #[IsSignatureValid], and #[IsCsrfTokenValid(...)] attributes allow you to define a methods: [...] argument to only enforce these checks for the listed HTTP methods and skip them... Affects symfony/http-kernel across 2 version ranges.
>= 7.4.0, < 7.4.12
>= 8.0.0, < 8.0.12
Fixed in 7.4.12 or 8.0.12, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony is a robust PHP framework used for building web applications. It provides a set of reusable components and a structured way to develop applications. The framework includes security features such as access control and CSRF protection, which are essential for safeguarding applications. However, a recent vulnerability has been identified that allows unauthorized access through HEAD requests, bypassing critical security checks.
Vulnerability Detail
The vulnerability arises from the way Symfony handles HTTP methods in its security attributes. Specifically, attributes like #[IsGranted('...')] and #[IsCsrfTokenValid(...)] can specify which HTTP methods to enforce checks on. When set to 'GET', these checks are ignored for HEAD requests, which are typically handled by the GET method. This means that a controller protected by these attributes can be accessed via a HEAD request without triggering the necessary authorization checks. As a result, sensitive information may be leaked through response headers, and unintended side effects such as database modifications can occur.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.4.0, < 7.4.127.4.12composer require symfony/http-kernel:7.4.12 -
>= 8.0.0, < 8.0.128.0.12composer require symfony/http-kernel:8.0.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the HEAD method for routes that require authorization checks. Ensure that sensitive actions are only accessible via methods that enforce the necessary security attributes.
Conclusion
In summary, CVE-2026-45075 is a significant vulnerability in Symfony that allows unauthorized access through HEAD requests, bypassing essential security checks. It is crucial to update to the patched versions of the affected packages to mitigate this risk. Additionally, using Vulert can help monitor your application for such vulnerabilities in real-time.
See every vulnerability recorded for symfony/http-kernel →
FAQ
The vulnerability allows unauthorized access to routes protected by Symfony's security attributes when accessed via HEAD requests, potentially leading to data leaks and unintended side effects.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability affects Symfony versions starting from 7.4.0 up to 7.4.11 and from 8.0.0 up to 8.0.11. Ensure you update to the fixed versions.
If an immediate update is not possible, avoid using HEAD requests for sensitive routes as a temporary workaround until you can apply the patch.
The CVSS score for this vulnerability is 6.2, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/http-kernel.
