Riskcovery

CVE-2026-45075

Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

State
Published
Severity
8.3 High
Published
Jul 14, 2026
Updated
Jul 16, 2026
Reserved
May 8, 2026

Read the record on cve.org

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12.

Scores

CVSSScoreVectorSource
4.08.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:NGitHub_M

Weaknesses

Affected Products

ProductVersions
symfonysymfony
  • >= 7.4.0-BETA1, < 7.4.12Affected
  • >= 8.0.0-BETA1, < 8.0.12Affected
http-kernelsymfony
  • >= 7.4.0-BETA1, < 7.4.12Affected
  • >= 8.0.0-BETA1, < 8.0.12Affected
security-httpsymfony
  • >= 7.4.0-BETA1, < 7.4.12Affected
  • >= 8.0.0-BETA1, < 8.0.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.