Kurz gesagt
- CVE-2026-34372 ist eine Schwachstelle (NIEDRIG (CVSS 2.7)) in sulu/sulu, sulu (sulu).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.27%, höher als bei 19.0% aller Schwachstellen.
- Abhilfe: auf 2.6.22, 3.0.5 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| sulu/sulu Packagist | ≥ 1.0.0, < 2.6.22≥ 3.0.0, < 3.0.5
| 2.6.223.0.5
|
| sulu | ≥ 1.0.0, < 2.6.22≥ 3.0.0, < 3.0.5
| 2.6.223.0.5
|
Description
Impact
A user which has permission for the Sulu Admin via atleast one role could have access to the subentities of contacts via the admin API without even have permission for contacts.
Patches
The issue was patched in release 2.6.22 and 3.0.5.
Workarounds
Create a Symfony Request Listener checking the permissions for the specific roles.
Resources
Github Advisory: https://github.com/sulu/sulu/security/advisories/GHSA-6h7h-m7p5-hjqp
NVD description
Sulu is an open-source PHP content management system based on the Symfony framework. From versions 1.0.0 to before 2.6.22, and 3.0.0 to before 3.0.5, a user which has permission for the Sulu Admin via at least one role could have access to the sub-entities of contacts via the admin API without even have permission for contacts. This issue has been patched in versions 2.6.22 and 3.0.5.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free