Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

Sulu admin may expose contact sub‑entities without proper rights

CVE-2026-34372 · published 7 months ago
Summary

Versions of the Sulu content system up to 2.6.21 and 3.0.4 let a user with any admin role view contact sub‑entity data through the API, even if they lack permission for contacts themselves. This can allow unauthorized access to personal or business information. Upgrade to Sulu 2.6.22 or later, or 3.0.5 or later, to enforce correct permission checks.

What to do
  • Update sulu sulu to version 2.6.22.
  • Update sulu sulu to version 3.0.5.
  • Update sulu sulu/sulu to version 2.6.22.
  • Update sulu sulu/sulu to version 3.0.5.
Affected software
Ecosystem VendorProductAffected versions
composer sulu sulu >= 1.0.0, < 2.6.22
>= 3.0.0, < 3.0.5
Fix: upgrade to 2.6.22
Packagist sulu sulu/sulu >= 1.0.0, < 2.6.22
>= 3.0.0, < 3.0.5
Fix: upgrade to 2.6.22
Original advisory text
Sulu checks fix permissions for subentities endpoints
Sulu is an open-source PHP content management system based on the Symfony framework. From versions 1.0.0 to before 2.6.22, and 3.0.0 to before 3.0.5, a user which has permission for the Sulu Admin via at least one role could have access to the sub-entities of contacts via the admin API without even have permission for contacts. This issue has been patched in versions 2.6.22 and 3.0.5.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-288Authentication Bypass Using Alternate Path
Timeline
Published31 Mar 2026
Updated4 Nov 2026
First seen30 Mar 2026
Sources
GHSA-6h7h-m7p5-hjqp · GHSA
CVE-2026-34372 · NVD
GHSA-6h7h-m7p5-hjqp · OSV
CVE-2026-34372 · OSV
Track software like this
Free during beta