https://vulnerability.circl.lu/sightings/feed 2026-09-02T23:39:07.317169+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/65b9c0bb-e33d-454d-ac25-5fb07b7e68b0/export 2026-09-02T23:39:07.344347+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "65b9c0bb-e33d-454d-ac25-5fb07b7e68b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82395", "type": "seen", "source": "https://gist.github.com/alon710/50fd67f360d5ae23eb1087ad318df483", "content": "# CVE-2026-82395: CVE-2026-82395: Insecure Direct Object Reference (IDOR) in Sulu CMS Media Move Authorization\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-82395\n\n## Summary\nSulu CMS, an open-source PHP content management system based on the Symfony framework, is affected by an Insecure Direct Object Reference (IDOR) vulnerability within its media relocation API. Authenticated users with restricted edit permissions can relocate media out of secure, unauthorized collections into folders they control, bypassing access controls entirely. This security issue is tracked under CVE-2026-82395 and GHSA-h6cx-gjxx-v25c.\n\n## TL;DR\nAn IDOR vulnerability in Sulu CMS allows low-privileged users with edit rights on at least one collection to steal restricted media files by moving them into accessible folders.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639 / CWE-863\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00246\n- **EPSS Percentile**: 15.73%\n- **Impact**: Partial Confidentiality & Integrity Loss\n- **Exploit Status**: PoC (Functional Integration Test Available)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Sulu CMS\n- **Sulu CMS**: < 2.6.25 (Fixed in: `2.6.25`)\n- **Sulu CMS**: >= 3.0.0-alpha1, < 3.0.8 (Fixed in: `3.0.8`)\n\n## Mitigation\n\n- Upgrade Sulu CMS to version 2.6.25 or 3.0.8.\n- Monitor administrative API move requests for cross-collection references.\n- Review database and audit logs for unauthorized media relocations.\n\n**Remediation Steps:**\n1. Assess current Sulu CMS deployment version.\n2. If using the 2.x branch, update dependencies to version 2.6.25.\n3. If using the 3.x branch, update dependencies to version 3.0.8.\n4. Flush backend caches and verify access control lists are operational.\n\n## References\n\n- [Sulu CMS Security Advisory GHSA-h6cx-gjxx-v25c](https://github.com/sulu/sulu/security/advisories/GHSA-h6cx-gjxx-v25c)\n- [Patch Commit](https://github.com/sulu/sulu/commit/2b959de75d61b98433e42db462c246ed9e4ce793)\n- [NVD Record for CVE-2026-82395](https://nvd.nist.gov/vuln/detail/CVE-2026-82395)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-82395) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T15:33:29.308492Z"} 2026-09-02T15:33:29.308492+00:00