PT-2026-44144 · Symfony · Symfony

Published 2026-05-21 · Updated 2026-05-27 · CVE-2026-45075

Positive Technologies (AI Summary)

CVSS v4.0

6.2

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 7.4

Description Attributes #[IsGranted('...')], #[IsSignatureValid], and #[IsCsrfTokenValid(...)] allow the definition of a methods: [...] argument to enforce checks only for specific HTTP methods. Because the router serves HEAD requests using the GET handler, a controller protected by an attribute specifying methods: ['GET'] can be accessed via a HEAD request, causing the authorization check to be skipped. This allows the controller to execute, potentially triggering side effects such as database writes or state changes, and may leak information through response headers like Content-Length and Location.

Recommendations Update to version 7.4 or later to ensure that adding GET to the methods option automatically includes the HEAD method.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-45075

GHSA-6439-2F28-8P8Q

Affected Products

Symfony

References · 14

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2026-45075.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2026-45075.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45075.yaml · Exploit
• https://ubuntu.com/security/CVE-2026-45075 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-45075 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45075 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45075 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6439-2f28-8p8q · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-45075 · Security Note
• https://github.com/symfony/symfony/security/advisories/GHSA-6439-2f28-8p8q · Note
• https://github.com/symfony/symfony · Note
• https://github.com/symfony/symfony/commit/fa8d5c67aa4b22c9656e3fd7d5c3aa59865bf838 · Note
• https://symfony.com/blog/cve-2026-45075-head-request-bypasses-methods-get-filter-in-isgranted-issignaturevalid-iscsrftokenvalid · Note
• https://symfony.com/cve-2026-45075 · Note