Junglewise Threat Intelligence

CVE-2026-82394: Sulu authorization bypass in preview link generation

CVE-2026-82394 · Severity: medium · CVSS 5.3 · Published 2026-09-02

Executive brief

Sulu is a content management system used to manage and publish website content with role-based access controls. A missing permission check in the preview link feature allows authenticated backend users to create shareable public links to content they should not be able to see, bypassing organizational content restrictions. Anyone with the preview link can view the restricted content without authentication, potentially exposing confidential or draft content to unauthorized parties.

Technical details

The vulnerability is a missing authorization check (CWE-862) in the PreviewLinkManager::generate() and revoke() methods, which are called by the PreviewLinkController endpoint. The vulnerable code never enforces a VIEW permission check on the target resource (page, article, or snippet) before creating or revoking a preview link. An authenticated backend user can specify any resource ID and receive a public render URL that resolves content solely via an opaque token, allowing unauthenticated access to restricted content. The fix adds a SecurityCheckerInterface permission check that verifies VIEW access on the resource's security context before allowing link generation or revocation, returning a 403 Forbidden response if unauthorized. The attack vector is network-accessible (via the administration interface) and requires low-level privileges (authenticated user account); no additional user interaction is needed.

Affected products

  • Sulu Sulu 2.6.24 and earlier; 3.0.0-alpha1 through 3.0.7

Timeline

  • 2026-07-20: disclosed: Initially published by GitHub
  • 2026-07-17: patched: Fix committed for 2.6.25 and 3.0.8
  • 2026-09-02: advisory: Published to GitHub Advisory Database

References

Related threats