CVE-2026-45075

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45075
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45075.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45075
Aliases
Downstream
Published
2026-07-14T18:40:37.287Z
Modified
2026-08-07T11:51:11.613327081Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
Details

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perform side effects. This issue is fixed in versions 7.4.12 and 8.0.12.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45075.json",
    "cwe_ids": [
        "CWE-863"
    ]
}
References

Affected packages

Git / github.com/symfony/security-http

Affected ranges

Type
GIT
Repo
https://github.com/symfony/security-http
Events
Introduced
92f9cc6494f3d29042ac35c2ee5209191bbbb781
Fixed
1fc7ca636cbd2cad29b42cc13c9fd0c681c6efee
Introduced
bea6dc79db4d95c34b77ec27273d812aa64d65be
Fixed
d776945b2dc41c0e609c56c1ef69863ab56856ed
Database specific 
{
    "extracted_events": [
        {
            "introduced": "7.4.0"
        },
        {
            "fixed": "7.4.12"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.12"
        }
    ],
    "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}
Type
GIT
Repo
https://github.com/symfony/symfony
Events
Introduced
25f2d564c9b8e93f1bfc1afa59c373e0409b599c
Fixed
275f5cbccbcc50205206f05e599c4f57009aadb8
Introduced
2e913a829cfbbf9cb38b321bdff1806b44b192eb
Fixed
06d3b2c9a8aeb5d8493738cc51e24f6a1215827c
Database specific 
{
    "extracted_events": [
        {
            "introduced": "7.4.0"
        },
        {
            "fixed": "7.4.12"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.12"
        }
    ],
    "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v7.*
v7.4.0
v7.4.1
v7.4.10
v7.4.11
v7.4.2
v7.4.3
v7.4.4
v7.4.5
v7.4.6
v7.4.7
v7.4.8
v7.4.9
v8.*
v8.0.0
v8.0.1
v8.0.10
v8.0.11
v8.0.2
v8.0.3
v8.0.4
v8.0.5
v8.0.6
v8.0.7
v8.0.8
v8.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45075.json"