CVE-2026-82395: Sulu CMS Auth Bypass Vulnerability

CVE-2026-82395 Overview

CVE-2026-82395 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in Sulu, an open-source PHP content management system built on the Symfony framework. The flaw resides in the media move endpoint, which derives its permission check from the client-supplied collection value rather than the media item's actual source collection. An authenticated backend user with edit rights on one collection can move media items out of restricted collections they should not access. Successful exploitation exposes confidential media content stored under access-controlled collections.

Critical Impact
Authenticated users with limited collection permissions can bypass access controls to view or download restricted media items by abusing the move endpoint in MediaManager::move().

Affected Products

Sulu CMS versions prior to 2.6.25
Sulu CMS 3.x versions prior to 3.0.8
src/Sulu/Bundle/MediaBundle/Media/Manager/MediaManager.php component

Discovery Timeline

2026-08-31 - CVE-2026-82395 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82395

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference in Sulu's media management workflow. The move endpoint accepts a collection identifier from the client and uses that value to evaluate whether the caller holds edit permission. The endpoint does not verify that the supplied collection is the actual source collection of the target media item. As a result, the permission decision is made against an attacker-controlled value rather than the object's true owner collection.

An authenticated backend user with edit permission on any collection can specify that allowed collection in the request while providing the identifier of a media item that resides in a restricted collection. The MediaManager::move() method then reassigns the item to a destination the attacker controls, granting read access to previously restricted content.

Root Cause

The root cause is missing authorization on the true source object. The pre-patch code path in MediaManager.php looked up the media entity but did not run a SecurityChecker check against the media's real previousCollectionId. Authorization was effectively delegated to a request parameter, which is the defining pattern of [CWE-639].

Attack Vector

The attack requires network access to the Sulu backend and low-privileged authenticated access with edit rights on at least one collection. The attacker also needs the numeric identifier of a target media item in a restricted collection. No user interaction is required beyond issuing the crafted API request to the move endpoint.

php

         $previousCollectionTitle = $previousCollectionMeta ? $previousCollectionMeta->getTitle() : null;
         $previousCollectionTitleLocale = $previousCollectionMeta ? $previousCollectionMeta->getLocale() : null;
 
+        if (null !== $this->securityChecker) {
+            // check the real source collection, not the collection sent in the request,
+            // and the destination the media is moved into
+            $this->securityChecker->checkPermission(
+                new SecurityCondition('sulu.media.collections', null, Collection::class, $previousCollectionId),
+                PermissionTypes::EDIT
+            );
+            $this->securityChecker->checkPermission(
+                new SecurityCondition('sulu.media.collections', null, Collection::class, $destCollection),
+                PermissionTypes::EDIT
+            );
+        }
+
         /** @var CollectionInterface $collection */
         $collection = $this->em->getReference(CollectionInterface::class, $destCollection);
         $mediaEntity->setCollection($collection);

Source: Sulu security patch commit 2b959de. The patch introduces two explicit SecurityChecker::checkPermission() calls: one against the true $previousCollectionId derived server-side, and one against the destination $destCollection.

Detection Methods for CVE-2026-82395

Indicators of Compromise

Unexpected media entries appearing in collections owned by low-privileged backend users, especially items previously stored in restricted collections.
Audit log entries showing MediaManager::move() operations where the acting user historically lacked visibility into the source collection.
Anomalous download activity on media items shortly after a move operation initiated by a non-privileged account.

Detection Strategies

Correlate Sulu backend API access logs for POST requests to the media move endpoint against the acting user's collection permission set.
Compare the collection request parameter with the media item's persisted collection identifier at the database layer; mismatches indicate probable abuse.
Alert on move operations where the source collection resolved server-side differs from any collection the requesting user holds edit rights on.

Monitoring Recommendations

Enable verbose application logging in the Sulu\Bundle\MediaBundle namespace to capture move operations with both requested and resolved collection IDs.
Ship Symfony application logs and web server access logs to a centralized log platform and retain them long enough to support retrospective hunting.
Monitor for enumeration patterns where a single authenticated user issues sequential requests referencing incrementing media identifiers.

How to Mitigate CVE-2026-82395

Immediate Actions Required

Upgrade Sulu to version 2.6.25 or 3.0.8 as published in the GitHub Security Advisory GHSA-h6cx-gjxx-v25c.
Review backend user accounts and revoke unnecessary collection edit permissions to shrink the pool of accounts that could exploit the pre-patch flaw.
Audit media collections for items that may have been moved without authorization prior to patching.

Patch Information

The fix is delivered in Sulu release 2.6.25 and Sulu release 3.0.8. The patch commit modifies MediaManager::move() to invoke SecurityChecker::checkPermission() against the server-resolved source collection and the destination collection before reassigning the media entity.

Workarounds

Restrict access to the Sulu admin backend to trusted network segments while patching is scheduled.
Temporarily reduce the number of accounts holding EDIT permission on any media collection to limit the exploit population.
Apply the upstream patch as a local backport if an immediate version upgrade is not feasible.

bash

# Upgrade Sulu via Composer to a patched release
composer require sulu/sulu:^2.6.25
# or, for the 3.x branch
composer require sulu/sulu:^3.0.8
composer update sulu/sulu --with-dependencies
php bin/console cache:clear --env=prod