~ / search / GHSA-6h7h-m7p5-hjqp

GHSA-6h7h-m7p5-hjqp

Sulu checks fix permissions for subentities endpoints

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-34372

Packages

EcosystemPackageAffectedFixed in
Packagist sulu/sulu >= 1.0.0, < 2.6.22 2.6.22
Packagist sulu/sulu >= 3.0.0, < 3.0.5 3.0.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A user which has permission for the Sulu Admin via atleast one role could have access to the subentities of contacts via the admin API without even have permission for contacts. ### Patches The issue was patched in release 2.6.22 and 3.0.5. ### Workarounds Create a Symfony Request Listener checking the permissions for the specific roles. ### Resources Github Advisory: https://github.com/sulu/sulu/security/advisories/GHSA-6h7h-m7p5-hjqp

References

External links from the advisory. They lead to third-party sites.