Junglewise Threat Intelligence

CVE-2026-82395: Sulu media move authorization bypass (IDOR)

CVE-2026-82395 · Severity: medium · CVSS 5.3 · Published 2026-09-02

Executive brief

Sulu is a headless CMS and content management platform. A flaw in the media move endpoint allows an authenticated backend user with edit rights to one collection to bypass authorization checks and move media files out of restricted collections they should not access. An attacker can then view and download restricted content by moving it to a collection they have access to, bypassing per-collection permission restrictions.

Technical details

The vulnerability is an Incorrect Authorization (CWE-863) and Authorization Bypass Through User-Controlled Key (CWE-639) flaw in the MediaManager::move() method. The media move endpoint resolves its permission check based on the `collection` value in the client request rather than checking the media's real source collection. This allows a user with EDIT permissions on an accessible collection A but no permissions on a restricted collection B to move media from B to A by specifying A in the request. The move succeeds because MediaManager::move() does not re-verify the user's permission on the media's actual source collection before reassigning it. Exploitation requires an authenticated backend user with edit rights on at least one collection and knowledge of the target media ID. The attack only affects installations using per-collection object-level permissions. Fixed in versions 2.6.25 and 3.0.8, where MediaManager::move() now verifies EDIT permission on both the media's real source collection and destination collection before performing the move.

Affected products

  • Sulu Sulu CMS 2.6.24 and earlier; 3.0.0-alpha1 through 3.0.7

Timeline

  • 2026-07-20: disclosed: Advisory GHSA-h6cx-gjxx-v25c published
  • 2026-07-17: patched: Fixed in Sulu 2.6.25 and 3.0.8
  • 2026-09-02: advisory: Published to GitHub Advisory Database

References