This is a security release. Upgrade as soon as possible. Before this fix, the custom-action route dispatcher could bypass the access_control rules defined in your Symfony security configuration.
Security fixes
[6228dfe] Re-validate access_control when dispatching custom-action routes (@javiereguiluz)
Full security advisory information:
GHSA-g2fm-8hr4-j82h