CVE-2026-34372mediumCWE-288

CVE-2026-34372: falha de média gravidade em sulu

Sulu checks fix permissions for subentities endpoints

Publicada em

Seguir esta CVE+ Monitorar sulu+ Monitorar sulu/sulu

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
Sulu is an open-source PHP content management system based on the Symfony framework. From versions 1.0.0 to before 2.6.22, and 3.0.0 to before 3.0.5, a user which has permission for the Sulu Admin via at least one role could have access to the sub-entities of contacts via the admin API without even have permission for contacts. This issue has been patched in versions 2.6.22 and 3.0.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
sulu · sulu
CVEs relacionadas — sulu

No mesmo produto, das mais perigosas para as menos.

CVE-2021-43836HIGHPHP file inclusion in the Sulu admin panelEPSS 2.0%CVE-2021-43835HIGHPrivilege escalation in the Sulu Admin panelEPSS 1.2%CVE-2020-15132MEDIUMReset Password / Login vulnerability in SuluEPSS 1.1%CVE-2021-32737HIGHXSS Injection in Media Collection Title was possibleEPSS 0.7%CVE-2023-39343MEDIUMSulu Observable Response Discrepancy on Admin LoginEPSS 0.6%CVE-2021-41169MEDIUMImproper Neutralization HTML tags in sulu/suluEPSS 0.6%