En bref
- CVE-2026-34372 est une vulnérabilité FAIBLE (CVSS 2.7) touchant sulu/sulu, sulu (sulu).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.27%, plus élevée que 19.0% des vulnérabilités.
- Correctif : mettre à jour vers 2.6.22, 3.0.5 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| sulu/sulu Packagist | ≥ 1.0.0, < 2.6.22≥ 3.0.0, < 3.0.5
| 2.6.223.0.5
|
| sulu | ≥ 1.0.0, < 2.6.22≥ 3.0.0, < 3.0.5
| 2.6.223.0.5
|
Description
Impact
A user which has permission for the Sulu Admin via atleast one role could have access to the subentities of contacts via the admin API without even have permission for contacts.
Patches
The issue was patched in release 2.6.22 and 3.0.5.
Workarounds
Create a Symfony Request Listener checking the permissions for the specific roles.
Resources
Github Advisory: https://github.com/sulu/sulu/security/advisories/GHSA-6h7h-m7p5-hjqp
NVD description
Sulu is an open-source PHP content management system based on the Symfony framework. From versions 1.0.0 to before 2.6.22, and 3.0.0 to before 3.0.5, a user which has permission for the Sulu Admin via at least one role could have access to the sub-entities of contacts via the admin API without even have permission for contacts. This issue has been patched in versions 2.6.22 and 3.0.5.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free