CVE-2026-82394: Sulu CMS Auth Bypass Vulnerability

CVE-2026-82394 Overview

Sulu is an open-source PHP content management system built on the Symfony framework. CVE-2026-82394 is a missing authorization vulnerability [CWE-862] in the preview-link functionality. The PreviewLinkManager::generate() and PreviewLinkManager::revoke() methods do not enforce VIEW permission on the target resource. An authenticated administration user who knows a resource identifier can create or revoke a preview link for any page, article, or snippet, including content in webspaces or areas the user cannot view. The generated preview URL is public and resolves content by an opaque token, letting anyone with the link read restricted content without authentication. The issue is fixed in Sulu versions 2.6.25 and 3.0.8.

Critical Impact
Any authenticated backend user can generate a public preview link to restricted content and share it with unauthenticated third parties, resulting in confidentiality loss across webspaces the user was never authorized to view.

Affected Products

Sulu CMS versions prior to 2.6.25 (2.x branch)
Sulu CMS versions prior to 3.0.8 (3.x branch)
sulu/sulu Composer package on affected release lines

Discovery Timeline

2026-08-31 - CVE-2026-82394 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-82394

Vulnerability Analysis

The flaw resides in src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php. Sulu's preview-link feature lets editors share a URL that renders draft content by resolving an opaque token, without requiring the recipient to authenticate. The generate() and revoke() methods validated that the caller was authenticated, but never checked whether the caller held VIEW permission on the referenced resource. Any backend user could therefore mint a preview link for any page, article, or snippet identifier and hand it to an external party.

Because preview URLs are unauthenticated by design, the missing check converts an authenticated authorization gap into an anonymous data exposure. Content restricted to specific webspaces, roles, or editorial groups becomes readable by anyone holding the token.

Root Cause

The root cause is a missing authorization check in the preview-link management layer. The manager class was not wired with a SecurityCheckerInterface, so it could not evaluate a SecurityCondition against PermissionTypes::VIEW before generating or revoking a preview link. Access control was implicitly delegated to the administration UI, which does not enforce object-level permissions on this endpoint.

Attack Vector

An attacker needs valid low-privilege backend credentials and knowledge or enumeration of a target resource identifier. The attacker calls the preview-link endpoint with the target identifier, receives a token-bearing URL, and distributes it. Recipients read the restricted content without any authentication step.

php

 use Sulu\Bundle\PreviewBundle\Domain\Model\PreviewLinkInterface;
 use Sulu\Bundle\PreviewBundle\Domain\Repository\PreviewLinkRepositoryInterface;
 use Sulu\Bundle\PreviewBundle\Preview\Object\PreviewObjectProviderRegistryInterface;
+use Sulu\Component\Security\Authorization\PermissionTypes;
+use Sulu\Component\Security\Authorization\SecurityCheckerInterface;
+use Sulu\Component\Security\Authorization\SecurityCondition;
 use Symfony\Component\Routing\RouterInterface;

 class PreviewLinkManager implements PreviewLinkManagerInterface

Source: GitHub Commit 44d8844 — the patch injects SecurityCheckerInterface and adds a SecurityCondition check for PermissionTypes::VIEW before generating or revoking preview links.

Detection Methods for CVE-2026-82394

Indicators of Compromise

Preview links in sulu_preview_link (or equivalent) records created by administration users who lack VIEW permission on the referenced resource.
Access log entries showing anonymous GET requests to /preview/{token} style routes for content in restricted webspaces.
Unexpected spikes in preview-link generation from low-privilege editor accounts.

Detection Strategies

Cross-reference audit logs of preview-link generate and revoke events against each user's effective role permissions on the target resource.
Query the preview-link table for entries whose creator lacks matching permission rows in Sulu's ACL tables.
Alert on unauthenticated web requests to preview endpoints originating from external IP ranges outside expected editorial reviewer networks.

Monitoring Recommendations

Ship Symfony and web-server access logs into a centralized log platform and retain preview-endpoint traffic for correlation.
Track per-user rates of preview-link creation and flag deviations from historical baselines.
Monitor Composer manifests across environments to confirm sulu/sulu is at 2.6.25, 3.0.8, or later.

How to Mitigate CVE-2026-82394

Immediate Actions Required

Upgrade sulu/sulu to version 2.6.25 (2.x branch) or 3.0.8 (3.x branch).
Enumerate existing preview links and revoke any created by users without VIEW permission on the target resource.
Rotate or invalidate outstanding preview tokens for sensitive webspaces after upgrading.
Review backend user accounts and remove unused low-privilege editor sessions that could be abused.

Patch Information

The fix is delivered in Sulu 2.6.25 and Sulu 3.0.8. The corrective change is documented in GitHub Commit 44d8844 and GHSA-65cv-w493-7vhq. The patch injects SecurityCheckerInterface into PreviewLinkManager and enforces a SecurityCondition check for PermissionTypes::VIEW in both generate() and revoke().

Workarounds

Restrict backend access to trusted networks with a reverse proxy or VPN until the upgrade is applied.
Temporarily disable the preview-link feature or block the preview-link route at the web-server layer.
Tighten role assignments so only vetted editors hold accounts that can call the preview-link endpoint.

bash

# Update Sulu via Composer to a patched release
composer require sulu/sulu:^3.0.8 --update-with-dependencies
# or for the 2.x branch
composer require sulu/sulu:^2.6.25 --update-with-dependencies
composer install --no-dev --optimize-autoloader
php bin/console cache:clear --env=prod