Sulu: Media move/update authorization bypass (IDOR)
Impact
A media move authorization bypass (IDOR) lets a backend user move a media out of a collection they have no access to.
The media move endpoint resolves its permission check from the collection value in the request rather than from the media's real collection. MediaManager::move() then reassigns the media without re-checking its actual source collection. A user who has edit rights on collection A but no rights on a restricted collection B can move a media that lives in B by naming A in the request. The move succeeds, the media ends up in A, and the user can then view and download content they were never allowed to see.
This only affects installations that use per-collection (object level) permissions to restrict some collections. Exploitation requires an authenticated backend user with edit rights on at least one collection, and knowledge of the target media id.
Patches
Fixed in 2.6.25 and 3.0.8. MediaManager::move() now verifies edit permission on the media's real source collection and on the destination collection before moving it.
Workarounds
If you cannot upgrade immediately:
- Restrict the media edit permission to trusted users, so untrusted users cannot trigger a move.
- Apply the fix manually by adding an edit permission check on the media's real source collection (and the destination) inside
MediaManager::move().
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | sulu/sulu | < 2.6.25, >= 3.0.0-alpha1, < 3.0.8 | 2.6.25, 3.0.8 |
Referencias
- https://github.com/sulu/sulu/security/advisories/GHSA-h6cx-gjxx-v25c
- https://nvd.nist.gov/vuln/detail/CVE-2026-82395
- https://github.com/sulu/sulu/commit/2b959de75d61b98433e42db462c246ed9e4ce793
- https://github.com/sulu/sulu
- https://github.com/sulu/sulu/releases/tag/2.6.25
- https://github.com/sulu/sulu/releases/tag/3.0.8
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N- Debilidad (CWE)
CWE-639, CWE-863- Plataforma
- Composer
- Paquete
sulu/sulu- Publicada
- 02.09.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-h6cx-gjxx-v25c - CC BY 4.0
Historial de vulnerabilidades: sulu/sulu
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 18
- Primera → última
- 08.2020 09.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 2
- Media 14
- Baja 2
Divulgaciones por año
- 2020: 1
- 2021: 4
- 2022: 0
- 2023: 1
- 2024: 4
- 2025: 1
- 2026: 7
-
Sulu: Media move/update authorization bypass (IDOR) esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.