CVE-2026-45755

MediumCVSS 5.3/10Last modified Jul 15, 2026

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse() received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged Mailtrap delivery, bounce, open, click, or spam events. This issue is fixed in versions 7.4.12 and 8.0.12.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-306 CWE-347

Affected software

Vendor	Product	Versions
symfony	symfony	>= 7.2.0, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12
/mailtrap-mailer	mailtrap-mailer	>= 7.2.0, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12

References

https://github.com/symfony/symfony/commit/4e0467e4e182cf2e704a3d9e1bc1a6be65d52ab8Patch
https://github.com/symfony/symfony/releases/tag/v7.4.12Product, Release Notes
https://github.com/symfony/symfony/releases/tag/v8.0.12Product, Release Notes
https://github.com/symfony/symfony/security/advisories/GHSA-59f3-vp2f-mp9wPatch, Vendor Advisory

Timeline

Published: Jul 14, 2026
Last modified: Jul 15, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-457567.5Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, CVE-2026-457572.3Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8 CVE-2026-457589.6Guardrails AI is a Python framework that helps build AI applications. On May 11, 2026 at approximately 6:00 PM Pacific, an attacker publishe CVE-2026-457597.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.CVE-2026-45762.4A vulnerability has been found in code-projects Exam Form Submission 1.0. Impacted is an unknown function of the file /admin/update_s5.php. CVE-2026-457608.1(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apach CVE-2026-457613.3Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.CVE-2026-457627.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.CVE-2026-457635.9Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.CVE-2026-457649.1Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.CVE-2026-457657.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.CVE-2026-457667.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.