Executive brief
Sulu is an open-source content management system (CMS) used to build and manage websites. A security flaw in how the system generates password reset tokens and API keys makes these sensitive credentials easier for attackers to predict or crack. If exploited, this could allow an attacker to gain unauthorized access to user accounts or administrative interfaces, potentially leading to data theft or website defacement.
Technical details
Sulu CMS is vulnerable to the use of a broken or risky cryptographic algorithm (CWE-327) within its SecurityBundle. Specifically, the components responsible for generating password reset tokens and API keys utilize a weak hashing mechanism rather than cryptographically secure pseudo-random generators. An unauthenticated remote attacker could potentially predict these tokens or keys, leading to account takeover or unauthorized API access. The vulnerability is located in User.php and ResettingController.php. This issue is resolved in versions 2.6.23 and 3.0.6.
Affected products
- Sulu Sulu < 2.6.23, < 3.0.6
Timeline
- 2026-05-04: patched: Versions 2.6.23 and 3.0.6 released.
- 2026-05-12: advisory: GitHub Security Advisory GHSA-7fv8-6pp7-6h85 published.
- 2026-06-01: disclosed: CVE-2026-45701 published to NVD.