CVE-2026-82395

Sulu: Media move/update authorization bypass (IDOR)

Workarounds

If you cannot upgrade immediately:

• Restrict the media edit permission to trusted users, so untrusted users cannot trigger a move.
• Apply the fix manually by adding an edit permission check on the media's real source collection (and the destination) inside MediaManager::move().

A media move authorization bypass (IDOR) lets a backend user move a media out of a collection they have no access to.

The media move endpoint resolves its permission check from the collection value in the request rather than from the media's real collection. MediaManager::move() then reassigns the media without re-checking its actual source collection. A user who has edit rights on collection A but no rights on a restricted collection B can move a media that lives in B by naming A in the request. The move succeeds, the media ends up in A, and the user can then view and download content they were never allowed to see.

This only affects installations that use per-collection (object level) permissions to restrict some collections. Exploitation requires an authenticated backend user with edit rights on at least one collection, and knowledge of the target media id.

The application does not correctly enforce access controls, allowing a principal to access resources or operations beyond their granted permissions. Typical impact: unauthorized data access or execution of privileged operations.

Kodem intelligence

Already deployed Kodem?

Fixed in 2.6.25 and 3.0.8. MediaManager::move() now verifies edit permission on the media's real source collection and on the destination collection before moving it.

1. What is CVE-2026-82395? CVE-2026-82395 is a medium-severity incorrect authorization vulnerability in sulu/sulu (composer), affecting versions <= 2.6.24. It is fixed in 2.6.25, 3.0.8. The application does not correctly enforce access controls, allowing a principal to access resources or operations beyond their granted permissions.
2. Which versions of sulu/sulu are affected by CVE-2026-82395? sulu/sulu (composer) versions <= 2.6.24 is affected.
3. Is there a fix for CVE-2026-82395? Yes. CVE-2026-82395 is fixed in 2.6.25, 3.0.8. Upgrade to this version or later.
4. Is CVE-2026-82395 exploitable, and should I be worried? Whether CVE-2026-82395 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-82395 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-82395?
   • Upgrade sulu/sulu to 2.6.25 or later
   • Upgrade sulu/sulu to 3.0.8 or later

Other vulnerabilities in sulu/sulu