CVE-2026-45075 – Authorization Bypass via HEAD Request – Symfony 7.4.0–7.4.11 and 8.0.0–8.0.11

Summary

CVE-2026-45075 is a high-severity authorization bypass vulnerability in Symfony, a widely-used PHP web application framework. When method-scoped security attributes (#[IsGranted], #[IsSignatureValid], #[IsCsrfTokenValid]) are configured to restrict checks to GET requests, an unauthenticated attacker can send an HTTP HEAD request to silently bypass the security check and reach the protected controller. The vulnerability is rated 8.3 (CVSS 4.0 / HIGH) and is classified under CWE-863: Incorrect Authorization.

Technical details

• Root cause: Symfony’s router forwards HEAD requests to GET handlers as required by HTTP semantics. However, when the optional methods: ['GET'] argument is used in a security attribute, the corresponding authorization check does not automatically extend to HEAD requests — causing it to be silently skipped rather than failing securely.
• Trigger conditions: The vulnerability only exists when controllers are decorated with #[IsGranted], #[IsSignatureValid], or #[IsCsrfTokenValid] using the optional methods: [...] argument scoped to GET. Controllers that use these attributes without method scoping are not affected.
• Attack vector: Unauthenticated, fully remote. An attacker sends a crafted HTTP HEAD request to a protected endpoint — no credentials, session token, or prior access required.
• Impact:
  • Authorization controls are silently bypassed, granting unauthenticated access to protected controller logic.
  • Response headers (e.g., Content-Length, Location, custom application headers) are returned, potentially leaking sensitive metadata about protected resources.
  • All controller side effects — including database writes, state mutations, and downstream operations — execute normally despite the absent authorization check.

Affected software

• symfony/symfony and symfony/security-http: versions ≥ 7.4.0 and < 7.4.12
• symfony/symfony and symfony/security-http: versions ≥ 8.0.0 and < 8.0.12

Severity

• CVSS 4.0: 8.3 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
• CVSS 3.1: 8.1 (HIGH) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• CWE: CWE-863 (Incorrect Authorization)

Mitigation and recommended actions

• Immediate — apply vendor patch: Upgrade Symfony to 7.4.12 or 8.0.12 (or any later release). The fix ensures that when GET is listed in the methods option of a security attribute, HEAD requests are automatically subject to the same authorization check.
• If immediate patching is not feasible: Audit your application for any controller using #[IsGranted], #[IsSignatureValid], or #[IsCsrfTokenValid] with a methods: [...] argument. For sensitive endpoints, consider temporarily blocking or restricting HEAD requests at the web server or reverse proxy layer (e.g., via nginx limit_except directives or Apache LimitExcept blocks) until the patch can be applied.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-45075 at NIST
• Symfony Security Advisory