| Package | Affected versions | Patched versions |
|---|---|---|
| sulu/sulu | ≥ 1.0.0, < 2.6.22≥ 3.0.0, < 3.0.5 | 2.6.223.0.5 |
| sulu | ≥ 1.0.0, < 2.6.22≥ 3.0.0, < 3.0.5 | 2.6.223.0.5 |
A user which has permission for the Sulu Admin via atleast one role could have access to the subentities of contacts via the admin API without even have permission for contacts.
The issue was patched in release 2.6.22 and 3.0.5.
Create a Symfony Request Listener checking the permissions for the specific roles.
Github Advisory: https://github.com/sulu/sulu/security/advisories/GHSA-6h7h-m7p5-hjqp
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free