CVE-2026-45754

MediumCVSS 5.3/10Last modified Jul 21, 2026

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-287 CWE-306

Affected software

Vendor	Product	Versions
symfony	symfony	>= 6.4.0, < 6.4.40; >= 7.0.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12
symfony	lox24-notifier	>= 7.1.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12
symfony	mailjet-mailer	>= 6.4.0, < 6.4.40; >= 7.0.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12

References

https://github.com/symfony/symfony/commit/3e52bf5ab733ee32e35eeeeb2631d859c941838ePatch
https://github.com/symfony/symfony/commit/4aaa45dd054f73445f1ab254968b7e60b546cc77Patch
https://github.com/symfony/symfony/releases/tag/v6.4.40Release Notes
https://github.com/symfony/symfony/releases/tag/v7.4.12Release Notes
https://github.com/symfony/symfony/releases/tag/v8.0.12Release Notes
https://github.com/symfony/symfony/security/advisories/GHSA-64hg-93w9-fc35Patch, Vendor Advisory

Timeline

Published: Jul 14, 2026
Last modified: Jul 21, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-457555.3Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapReques CVE-2026-457567.5Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, CVE-2026-457572.3Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8 CVE-2026-457589.6Guardrails AI is a Python framework that helps build AI applications. On May 11, 2026 at approximately 6:00 PM Pacific, an attacker publishe CVE-2026-457597.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.CVE-2026-45762.4A vulnerability has been found in code-projects Exam Form Submission 1.0. Impacted is an unknown function of the file /admin/update_s5.php. CVE-2026-457608.1(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apach CVE-2026-457613.3Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.CVE-2026-457627.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.CVE-2026-457635.9Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.CVE-2026-457649.1Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.CVE-2026-457657.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.