Read the docs
TI-2026-56811 Aliases CVE-2026-82394GHSA-65cv-w493-7vhq

Sulu: Fix authorization bypass when creating preview links

Priority LOW 25CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php do not enforce VIEW permission for the target resource in PreviewLinkManager::generate() or PreviewLinkManager::revoke(). An authenticated administration user who knows a target resource identifier can create or revoke a preview link for any page, article, or snippet, including content in a webspace or area the user cannot view. A generated preview URL is public and resolves content by an opaque token, allowing the user or anyone receiving the link to read restricted content without authentication. This issue is fixed in versions 2.6.25 and 3.0.8.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00576 47th percentileScored 2026-11-07
Fix Fixed sulu (sulu): 2.6.25, 3.0.8sulu/sulu (Packagist): 2.6.25, 3.0.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sulusulubefore 2.6.25; 3.0.0-alpha1 to before 3.0.82.6.25, 3.0.8Patch availableCNA
—sulu/sulu (Packagist)before 2.6.252.6.25Patch availableGHSA-65cv-w493-7vhq
—sulu/sulu (Packagist)3.0.0-alpha1 to before 3.0.83.0.8Patch availableGHSA-65cv-w493-7vhq
  • sulu Vendorsulu Affected before 2.6.25; 3.0.0-alpha1 to before 3.0.8 Fixed in 2.6.25, 3.0.8 Patch available CNA
  • sulu/sulu (Packagist) Vendor— Affected before 2.6.25 Fixed in 2.6.25 Patch available GHSA-65cv-w493-7vhq
  • sulu/sulu (Packagist) Vendor— Affected 3.0.0-alpha1 to before 3.0.8 Fixed in 3.0.8 Patch available GHSA-65cv-w493-7vhq

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:*——sulu
  • cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:* Versions — — ·sulu

Remediation

  • Fix · CNA sulu (sulu) Fixed in 2.6.25, 3.0.8
  • Fix · GHSA-65cv-w493-7vhq sulu/sulu (Packagist) Fixed in 2.6.25 Advisory →
  • Fix · GHSA-65cv-w493-7vhq sulu/sulu (Packagist) Fixed in 3.0.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82394
  2. 2026-10-03 Alias added: GHSA-65cv-w493-7vhq

References

Advisory 1

Other 5

  • TI-2021-19642 PHP file inclusion in the Sulu admin panel CVSS 3.1HIGH 8.8
  • TI-2024-18520 Sulu grants access to pages regardless of role permissions CVSS 3.1HIGH 8.1
  • TI-2021-12405 XSS Injection in Media Collection Title was possible CVSS 3.1HIGH 8.4
  • TI-2026-33442 Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens CVSS 4.0MEDIUM 6.9
  • TI-2025-30243 Sulu vulnerable to XXE in SVG File upload Inspector CVSS 4.0MEDIUM 6.1
  • TI-2021-19641 Privilege escalation in the Sulu Admin panel CVSS 3.1HIGH 7.2
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences