6.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45075

CVE-2026-45075: Synfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

Description

Symfony's #[IsGranted('...')], #[IsSignatureValid], and #[IsCsrfTokenValid(...)] attributes allow you to define a methods: [...] argument to only enforce these checks for the listed HTTP methods and skip them otherwise. E.g. an attribute defining methods: ['GET'] would be ignored for a HEAD request.

On the other hand, Symfony's router (and HTTP semantics generally) serves HEAD requests using the GET handler. Therefore, a controller protected by e.g. #[IsGranted('ROLE_ADMIN', methods: ['GET'])] can be reached via HEAD with the authorization check silently skipped.

Even if the HEAD request won't get any response content, response headers leak (Content-Length, Location, custom headers). Also, the controller still executes and any side effects (DB writes, state changes) occur.

Resolution

When adding GET in the methods option of these attributes, Symfony now also include the HEAD method automatically.

The patch for this issue is available here for branch 7.4.

Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and Alexandre Daubois for fixing it.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45075

CVE-2026-45075:

6.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
symfony/http-kernel	composer	>= 7.4.0, < 7.4.12	7.4.12
symfony/http-kernel	composer	>= 8.0.0, < 8.0.12	8.0.12
symfony/security-http	composer	>= 7.4.0, < 7.4.12	7.4.12
symfony/security-http	composer	>= 8.0.0, < 8.0.12	8.0.12
symfony/symfony	composer	>= 7.4.0, < 7.4.12	7.4.12
symfony/symfony	composer	>= 8.0.0, < 8.0.12	8.0.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in several Symfony event listeners responsible for enforcing security attributes: IsGranted, IsCsrfTokenValid, and IsSignatureValid. These attributes can be configured to apply only to specific HTTP methods, such as ['GET'].

Symfony's routing component treats HEAD requests as a variant of GET requests, executing the same controller logic but omitting the response body. However, the event listeners for the security attributes did not account for this behavior. When an attribute was configured with methods: ['GET'], the listener would check the request method. For a HEAD request, the check !in_array('HEAD', ['GET']) would pass, causing the listener to skip the security validation (authorization, CSRF token, or signature check).

This allowed an attacker to bypass these security controls by sending a HEAD request to an endpoint that was intended to be protected for GET requests. Although the attacker would not receive the response body, the controller action would still execute, potentially leading to unauthorized state changes (e.g., database writes) or leakage of sensitive information through response headers.

The patch addresses this by modifying the constructors of the IsGranted, IsCsrfTokenValid, and IsSignatureValid attributes. The new logic automatically adds HEAD to the list of methods whenever GET is specified, ensuring that the security checks are correctly applied to both GET and HEAD requests by the respective listeners.

The identified vulnerable functions are the onKernelControllerArguments methods within the listeners, as these are the exact locations in the code where the faulty method check occurs, leading to the bypass.

Vulnerable functions

Symfony\Component\HttpKernel\EventListener\IsSignatureValidAttributeListener::onKernelControllerArguments

src/Symfony/Component/HttpKernel/EventListener/IsSignatureValidAttributeListener.php

This function listens for controller arguments and checks if the `IsSignatureValid` attribute should be enforced. Before the patch, if the attribute was configured with `methods: ['GET']`, this function would not check the signature for a `HEAD` request, because `HEAD` was not in the methods list. This allowed bypassing the signature validation by using a `HEAD` request instead of `GET`.

Symfony\Component\Security\Http\EventListener\IsCsrfTokenValidAttributeListener::onKernelControllerArguments

src/Symfony/Component/Security/Http/EventListener/IsCsrfTokenValidAttributeListener.php

This function listens for controller arguments and checks if the `IsCsrfTokenValid` attribute should be enforced. Before the patch, if the attribute was configured with `methods: ['GET']`, this function would not validate the CSRF token for a `HEAD` request. This allowed an attacker to bypass CSRF protection on actions that were supposed to be protected for GET requests.

Symfony\Component\Security\Http\EventListener\IsGrantedAttributeListener::onKernelControllerArguments

src/Symfony/Component/Security/Http/EventListener/IsGrantedAttributeListener.php

This function listens for controller arguments and performs authorization checks based on the `IsGranted` attribute. Before the patch, if the attribute was configured with `methods: ['GET']`, this function would skip the authorization check for a `HEAD` request. This allowed an attacker to bypass authorization controls by sending a `HEAD` request to an endpoint that was protected for `GET` requests, leading to potential unauthorized execution of controller logic.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.