CVE-2026-82395: Sulu: Media move/update authorization bypass (IDOR)
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and src/Sulu/Bundle/MediaBundle/Media/Manager/MediaManager.php allows MediaManager::move() to reassign the item without checking that source. An authenticated backend user with edit permission on one collection and knowledge of a target media identifier can name the allowed collection in the request, move an item out of a restricted collection, and then view or download content the user was not permitted to access. This issue is fixed in versions 2.6.25 and 3.0.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Suluto a version that resolves this vulnerability.Fixed in 2.6.25 - Upgrade
Upgrade
Suluto a version that resolves this vulnerability.Fixed in 3.0.8
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated Sulu backend user can exploit it if they have edit permission on at least one collection and know the identifier of media stored in a restricted collection. The user does not need permission for the media item's actual source collection.
Are default deployments affected?
The issue depends on collection-level permission differences. It is relevant where a backend user can edit one collection but should not be able to access media in another restricted collection.
What is the impact of a successful exploit?
The attacker can move a media item from a restricted collection by supplying a collection they are allowed to edit. They can then view or download content they were not authorized to access.
Which versions contain the fix?
Upgrade to Sulu 2.6.25 or 3.0.8. Versions earlier than those releases are affected.