CVE-2026-82394: Sulu: Fix authorization bypass when creating preview links
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php do not enforce VIEW permission for the target resource in PreviewLinkManager::generate() or PreviewLinkManager::revoke(). An authenticated administration user who knows a target resource identifier can create or revoke a preview link for any page, article, or snippet, including content in a webspace or area the user cannot view. A generated preview URL is public and resolves content by an opaque token, allowing the user or anyone receiving the link to read restricted content without authentication. This issue is fixed in versions 2.6.25 and 3.0.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suluto a version that resolves this vulnerability.Fixed in 2.6.25 - Upgrade
Upgrade
Suluto a version that resolves this vulnerability.Fixed in 3.0.8
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Sulu administration user can exploit it if they know the identifier of a target page, article, or snippet. The user does not need VIEW permission for that resource and may target content in webspaces or areas they cannot view.
What access does a generated preview link provide?
The generated preview URL is public and uses an opaque token to resolve the content. Anyone who receives the link can read the restricted content without authenticating.
Are both preview-link creation and revocation affected?
Yes. The affected PreviewLinkManager::generate() and PreviewLinkManager::revoke() operations do not enforce VIEW permission for the target resource.
Which versions contain the fix?
The issue is fixed in Sulu versions 2.6.25 and 3.0.8.