CVE-2017-11365: Symfony Incorrect Access Control

critical Affects symfony/security, symfony/security-core, symfony/symfony. Feed 2026.10.29.1, updated 2026-10-28; published ; advisory modified .

Symfony Incorrect Access Control

Package
symfony/security Composer
Affected versions
>=2.7.30 and <2.7.32 or >=2.8.23 and <2.8.25 or >=3.2.10 and <3.2.12 or >=3.3.3 and <3.3.5
Fixed in
2.7.32, 2.8.25, 3.2.12, 3.3.5
Severity
critical  CVSS 9.8
Exploitation
not on CISA KEV · EPSS 2% (79.1th percentile)
Published
2022-05-24
Source
osv.dev

References

Symfony Incorrect Access Control

Package
symfony/security-core Composer
Affected versions
>=2.7.30 and <2.7.32 or >=2.8.23 and <2.8.25 or >=3.2.10 and <3.2.12 or >=3.3.3 and <3.3.5
Fixed in
2.7.32, 2.8.25, 3.2.12, 3.3.5
Severity
critical  CVSS 9.8
Exploitation
not on CISA KEV · EPSS 2% (79.1th percentile)
Published
2022-05-24
Source
osv.dev

References

Symfony Incorrect Access Control

Package
symfony/symfony Composer
Affected versions
>=2.7.30 and <2.7.32 or >=2.8.23 and <2.8.25 or >=3.2.10 and <3.2.12 or >=3.3.3 and <3.3.5
Fixed in
2.7.32, 2.8.25, 3.2.12, 3.3.5
Severity
critical  CVSS 9.8
Exploitation
not on CISA KEV · EPSS 2% (79.1th percentile)
Published
2022-05-24
Source
osv.dev

References

CWE-284
NVD recordsymfony/security advisoriessymfony/security-core advisoriessymfony/symfony advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs   How findings are ranked

Related advisories