CVE-2026-82395: Insecure Direct Object Reference (IDOR) in Sulu CMS Media Move Authorization
Vulnerability ID: CVE-2026-82395
CVSS Score: 5.3
Published: 2026-09-02
Sulu CMS, an open-source PHP content management system based on the Symfony framework, is affected by an Insecure Direct Object Reference (IDOR) vulnerability within its media relocation API. Authenticated users with restricted edit permissions can relocate media out of secure, unauthorized collections into folders they control, bypassing access controls entirely. This security issue is tracked under CVE-2026-82395 and GHSA-h6cx-gjxx-v25c.
TL;DR
An IDOR vulnerability in Sulu CMS allows low-privileged users with edit rights on at least one collection to steal restricted media files by moving them into accessible folders.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-639 / CWE-863
- Attack Vector: Network
- CVSS v4.0 Score: 5.3 (Medium)
- EPSS Score: 0.00246
- EPSS Percentile: 15.73%
- Impact: Partial Confidentiality & Integrity Loss
- Exploit Status: PoC (Functional Integration Test Available)
- KEV Status: Not Listed
Affected Systems
- Sulu CMS
-
Sulu CMS: < 2.6.25 (Fixed in:
2.6.25) -
Sulu CMS: >= 3.0.0-alpha1, < 3.0.8 (Fixed in:
3.0.8)
Code Analysis
Commit: 2b959de
Check permissions on media move source/target in MediaManager::move()
Exploit Details
- GitHub Security Advisory: Contains functional integration test demonstrating authorization bypass.
Mitigation Strategies
- Upgrade Sulu CMS to version 2.6.25 or 3.0.8.
- Monitor administrative API move requests for cross-collection references.
- Review database and audit logs for unauthorized media relocations.
Remediation Steps:
- Assess current Sulu CMS deployment version.
- If using the 2.x branch, update dependencies to version 2.6.25.
- If using the 3.x branch, update dependencies to version 3.0.8.
- Flush backend caches and verify access control lists are operational.
References
Read the full report for CVE-2026-82395 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)