CVE-2026-82395: Sulu media move authorization bypass (IDOR)

CVE-2026-82395 · Severity: medium · CVSS 4 · Published 2026-08-31

Sulu is a headless CMS and content management platform. A flaw in the media move endpoint allows an authenticated backend user with edit rights to one collection to bypass authorization checks and move media files out of restricted collections they should not access. An attacker can then view and download restricted content by moving it to a collection they have access to, bypassing per-collection permission restrictions.

Technologies: sulu/sulu (Packagist). Vendors: Packagist, Sulu.

Quick answers

Is CVE-2026-82395 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-82395 being exploited in the wild.
How severe is CVE-2026-82395?
Medium severity, with a CVSS score of 4, published 31 August 2026.
Which products and versions are affected?
sulu/sulu (Packagist) ECOSYSTEM:introduced=0,fixed=2.6.25; Sulu CMS 2.6.24 and earlier; 3.0.0-alpha1 through 3.0.7.
Is there a fix for CVE-2026-82395?
Yes. sulu/sulu (Packagist): upgrade to 2.6.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82395 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-82395?
Check whether you run sulu/sulu (Packagist) or Sulu CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • sulu/sulu (Packagist): upgrade to 2.6.25 or later
    composer require sulu/sulu:^2.6.25

Technical details

The vulnerability is an Incorrect Authorization (CWE-863) and Authorization Bypass Through User-Controlled Key (CWE-639) flaw in the MediaManager::move() method. The media move endpoint resolves its permission check based on the `collection` value in the client request rather than checking the media's real source collection. This allows a user with EDIT permissions on an accessible collection A but no permissions on a restricted collection B to move media from B to A by specifying A in the request. The move succeeds because MediaManager::move() does not re-verify the user's permission on the media's actual source collection before reassigning it. Exploitation requires an authenticated backend user with edit rights on at least one collection and knowledge of the target media ID. The attack only affects installations using per-collection object-level permissions. Fixed in versions 2.6.25 and 3.0.8, where MediaManager::move() now verifies EDIT permission on both the media's real source collection and destination collection before performing the move.

Affected products

  • Sulu Sulu CMS 2.6.24 and earlier; 3.0.0-alpha1 through 3.0.7

Identifiers

  • CVE-2026-82395
  • GHSA-h6cx-gjxx-v25c

Timeline

  • 2026-07-20: disclosed: Advisory GHSA-h6cx-gjxx-v25c published
  • 2026-07-17: patched: Fixed in Sulu 2.6.25 and 3.0.8
  • 2026-09-02: advisory: Published to GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.