CVE-2026-82394: Sulu authorization bypass in preview link generation

CVE-2026-82394 · Severity: medium · CVSS 4 · Published 2026-08-31

Sulu is a content management system used to manage and publish website content with role-based access controls. A missing permission check in the preview link feature allows authenticated backend users to create shareable public links to content they should not be able to see, bypassing organizational content restrictions. Anyone with the preview link can view the restricted content without authentication, potentially exposing confidential or draft content to unauthorized parties.

Technologies: sulu/sulu (Packagist), Sulu. Vendors: Packagist, Sulu.

Quick answers

Is CVE-2026-82394 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-82394 being exploited in the wild.
How severe is CVE-2026-82394?
Medium severity, with a CVSS score of 4, published 31 August 2026.
Which products and versions are affected?
sulu/sulu (Packagist) ECOSYSTEM:introduced=0,fixed=2.6.25; Sulu 2.6.24 and earlier; 3.0.0-alpha1 through 3.0.7.
Is there a fix for CVE-2026-82394?
Yes. sulu/sulu (Packagist): upgrade to 2.6.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82394 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-82394?
Check whether you run sulu/sulu (Packagist) or Sulu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • sulu/sulu (Packagist): upgrade to 2.6.25 or later
    composer require sulu/sulu:^2.6.25

Technical details

The vulnerability is a missing authorization check (CWE-862) in the PreviewLinkManager::generate() and revoke() methods, which are called by the PreviewLinkController endpoint. The vulnerable code never enforces a VIEW permission check on the target resource (page, article, or snippet) before creating or revoking a preview link. An authenticated backend user can specify any resource ID and receive a public render URL that resolves content solely via an opaque token, allowing unauthenticated access to restricted content. The fix adds a SecurityCheckerInterface permission check that verifies VIEW access on the resource's security context before allowing link generation or revocation, returning a 403 Forbidden response if unauthorized. The attack vector is network-accessible (via the administration interface) and requires low-level privileges (authenticated user account); no additional user interaction is needed.

Affected products

  • Sulu Sulu 2.6.24 and earlier; 3.0.0-alpha1 through 3.0.7

Identifiers

  • CVE-2026-82394
  • GHSA-65cv-w493-7vhq

Timeline

  • 2026-07-20: disclosed: Initially published by GitHub
  • 2026-07-17: patched: Fix committed for 2.6.25 and 3.0.8
  • 2026-09-02: advisory: Published to GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.