GitHub Advisoryadvisory · Packagist

GHSA-6h7h-m7p5-hjqp Sulu checks fix permissions for subentities endpoints

MEDIUM Published 2026-03-30 Modified 2026-03-31 Official page ↗
Aliases
CVE-2026-34372
Ecosystem
Packagist
Packages
sulu/sulu
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-288
Reviewed
2026-03-30

Affected packages

• Packagist sulu/sulu: >= 1.0.0, < 2.6.22 → fixed in 2.6.22 • Packagist sulu/sulu: >= 3.0.0, < 3.0.5 → fixed in 3.0.5

Description

Impact A user which has permission for the Sulu Admin via atleast one role could have access to the subentities of contacts via the admin API without even have permission for contacts. Patches The issue was patched in release 2.6.22 and 3.0.5. Workarounds Create a Symfony Request Listener checking the permissions for the specific roles. Resources Github Advisory: https://github.com/sulu/sulu/security/advisories/GHSA-6h7h-m7p5-hjqp

Related

Alias · CVE (1)

  • CVE-2026-34372 Sulu is an open-source PHP content management system based on the Symfony framework. vulnerability

Weakness · CWE (1)

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness

References