Read the docs
TI-2026-56812 Aliases CVE-2026-82395GHSA-h6cx-gjxx-v25c

Sulu: Media move/update authorization bypass (IDOR)

Priority LOW 24CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and src/Sulu/Bundle/MediaBundle/Media/Manager/MediaManager.php allows MediaManager::move() to reassign the item without checking that source. An authenticated backend user with edit permission on one collection and knowledge of a target media identifier can name the allowed collection in the request, move an item out of a restricted collection, and then view or download content the user was not permitted to access. This issue is fixed in versions 2.6.25 and 3.0.8.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00427 37th percentileScored 2026-11-07
Fix Fixed sulu (sulu): 2.6.25, 3.0.8sulu/sulu (Packagist): 2.6.25, 3.0.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sulusulubefore 2.6.25; 3.0.0-alpha1 to before 3.0.82.6.25, 3.0.8Patch availableCNA
—sulu/sulu (Packagist)before 2.6.252.6.25Patch availableGHSA-h6cx-gjxx-v25c
—sulu/sulu (Packagist)3.0.0-alpha1 to before 3.0.83.0.8Patch availableGHSA-h6cx-gjxx-v25c
  • sulu Vendorsulu Affected before 2.6.25; 3.0.0-alpha1 to before 3.0.8 Fixed in 2.6.25, 3.0.8 Patch available CNA
  • sulu/sulu (Packagist) Vendor— Affected before 2.6.25 Fixed in 2.6.25 Patch available GHSA-h6cx-gjxx-v25c
  • sulu/sulu (Packagist) Vendor— Affected 3.0.0-alpha1 to before 3.0.8 Fixed in 3.0.8 Patch available GHSA-h6cx-gjxx-v25c

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:*——sulu
  • cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:* Versions — — ·sulu

Remediation

  • Fix · CNA sulu (sulu) Fixed in 2.6.25, 3.0.8
  • Fix · GHSA-h6cx-gjxx-v25c sulu/sulu (Packagist) Fixed in 2.6.25 Advisory →
  • Fix · GHSA-h6cx-gjxx-v25c sulu/sulu (Packagist) Fixed in 3.0.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82395
  2. 2026-10-03 Alias added: GHSA-h6cx-gjxx-v25c

References

Advisory 1

Other 5

  • TI-2021-19642 PHP file inclusion in the Sulu admin panel CVSS 3.1HIGH 8.8
  • TI-2024-18520 Sulu grants access to pages regardless of role permissions CVSS 3.1HIGH 8.1
  • TI-2021-12405 XSS Injection in Media Collection Title was possible CVSS 3.1HIGH 8.4
  • TI-2026-33442 Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens CVSS 4.0MEDIUM 6.9
  • TI-2025-30243 Sulu vulnerable to XXE in SVG File upload Inspector CVSS 4.0MEDIUM 6.1
  • TI-2021-19641 Privilege escalation in the Sulu Admin panel CVSS 3.1HIGH 7.2
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences