GHSA-7mx2-7q8p-pgmw: 
PHP vulnerability analysis and mitigation

A security vulnerability was discovered in Symfony's EntityUserProvider component within the Doctrine bridge, affecting versions 2.0.0 through 2.0.6. The vulnerability allows users to potentially switch to another user's identity when updating their username through a form, particularly when using Doctrine as a user provider (Symfony Blog).

The vulnerability occurs in the user refresh mechanism where the system uses the username instead of the primary key to reload user data. When a user attempts to change their username to that of another existing user through a form, although validation errors occur, the user object in the session gets modified with the new username. This modified session user is then used for subsequent requests, effectively allowing the user to assume the identity of another user (GitHub Advisory). The vulnerability has been assigned a CVSS v3.1 score of 6.5 (Moderate), with attack vector being Network, attack complexity Low, and requiring Low privileges (GitHub Advisory).

The vulnerability enables unauthorized users to switch to another user's identity, potentially gaining access to sensitive information and functionality intended for other users. This could lead to unauthorized access to protected resources and potential impersonation of other users in the system (GitHub Advisory).

The vulnerability can be exploited when a user attempts to update their username via a form to match another existing username. Despite receiving validation errors due to the duplicate username, the session maintains the modified username, allowing the user to effectively switch to the other user's identity in subsequent requests (Symfony Blog).

The vulnerability was fixed in Symfony version 2.0.6. The fix involves modifying the user refresh mechanism to always refresh the user via the primary key instead of the username, as the primary key cannot be updated via a form. For users unable to upgrade immediately, a patch was provided at symfony/symfony@9d2ab9ca9c1762. The fix ensures that user identification is based on immutable primary keys rather than potentially mutable usernames (Symfony Blog).