CVE-2026-49215

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49215
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49215.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49215
Aliases
Published
2026-07-17T16:16:42.126Z
Modified
2026-07-19T03:47:16.636013919Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted
Details

Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\EventListener\LiveComponentSubscriber::isLiveComponentRequest() gates #[LiveAction] invocations on Accept: application/vnd.live-component+html, but the Accept header is CORS-safelisted and cross-origin fetch() can set it without preflight, allowing forged cross-origin #[LiveAction] requests against a victim session when applications use SameSite=None, credentials: 'include', a permissive cookie policy, or a same-origin pivot. This issue is fixed in versions 2.36.0 and 3.1.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49215.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-352"
    ]
}
References

Affected packages

Git / github.com/symfony/ux

Affected ranges

Type
GIT
Repo
https://github.com/symfony/ux
Events
Introduced
3cef8e0d9557bbde60c3f1bfd2cbb1004af7fc9a
Introduced
fd7609f5c514350261bf8431c9b09533c89040f1
Fixed
4c883fdb0f0e7ea577f851bd457024f7e88788c9
Fixed
5ccec9746faa28d79a87138042174c3853d5702b
Fixed
aed7493db2b4b7bf1f9c79b33cda544f06904b27
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.1.0"
        },
        {
            "introduced": "2.22.0"
        },
        {
            "fixed": "2.36.0"
        }
    ]
}

Affected versions

v2.*
v2.22.0
v2.22.1
v2.23.0
v2.24.0
v2.25.0
v2.25.1
v2.25.2
v2.26.0
v2.26.1
v2.27.0
v2.28.0
v2.28.1
v2.28.2
v2.29.0
v2.29.1
v2.29.2
v2.30.0
v2.31.0
v2.32.0
v2.33.0
v2.34.0
v2.35.0
v3.*
v3.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49215.json"