Access Control Flaw in Sulu PHP Content Management System
CVE-2026-82395
5.3MEDIUM
What is CVE-2026-82395?
Sulu, an open-source PHP content management system developed on the Symfony framework, exhibits a significant access control flaw in its media move endpoint. The vulnerability allows an authenticated backend user with editing rights on a particular collection to manipulate requests and gain unauthorized access to restricted media items in other collections. Specifically, due to a misconfigured permission check that derives from a user-supplied collection value instead of the actual media item's collection, this flaw enables potential unauthorized viewing or downloading of sensitive content. The issue has been addressed in Sulu CMS versions 2.6.25 and 3.0.8.
Affected Version(s)
sulu < 2.6.25 < 2.6.25
sulu >= 3.0.0-alpha1, < 3.0.8 < 3.0.0-alpha1, 3.0.8