CVE-2026-82394

Sulu: Fix authorization bypass when creating preview links

Workarounds

If you cannot upgrade immediately:

• Restrict backend access so that only trusted users can reach the administration interface.
• Apply the fix manually by adding a VIEW permission check (via SecurityCheckerInterface and the resource's security context) inside PreviewLinkManager::generate() and revoke().

A missing authorization check on the preview link endpoint lets a backend user create a public, unauthenticated preview URL for content they are not allowed to see.

PreviewLinkController (and the underlying PreviewLinkManager::generate() / revoke()) never enforced a permission on the target resource. Any authenticated administration user could call the generate action for any page, article or snippet, including content in a webspace or area they have no VIEW rights on. The endpoint returns a public render URL that resolves the content solely by an opaque token, so the attacker (or anyone they share the link with) can then read the restricted content without authentication.

This affects installations that use Sulu role and webspace permissions to restrict who may see certain content. Exploitation requires an authenticated backend user and the id of the target resource.

The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.

Kodem intelligence

Already deployed Kodem?

Fixed in 2.6.x and 3.0.x. PreviewLinkManager::generate() and revoke() now resolve the resource's security context and enforce a VIEW permission check before a preview link is created or removed. A user without VIEW access on the resource receives a 403 response and no link is created.

Note on scope: this patch closes the authorization bypass. Two related hardening items from the original report are tracked as a separate follow-up because they require a database migration:

• The preview link token is derived from substr(md5(uuid), 0, 12) (about 48 bits of entropy).
• Preview links never expire.

1. What is CVE-2026-82394? CVE-2026-82394 is a medium-severity missing authorization vulnerability in sulu/sulu (composer), affecting versions <= 2.6.24. It is fixed in 2.6.25, 3.0.8. The application does not perform an authorization check before performing a sensitive operation.
2. Which versions of sulu/sulu are affected by CVE-2026-82394? sulu/sulu (composer) versions <= 2.6.24 is affected.
3. Is there a fix for CVE-2026-82394? Yes. CVE-2026-82394 is fixed in 2.6.25, 3.0.8. Upgrade to this version or later.
4. Is CVE-2026-82394 exploitable, and should I be worried? Whether CVE-2026-82394 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-82394 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-82394?
   • Upgrade sulu/sulu to 2.6.25 or later
   • Upgrade sulu/sulu to 3.0.8 or later

Other vulnerabilities in sulu/sulu