GHSA-6h7h-m7p5-hjqpMedium

Sulu checks fix permissions for subentities endpoints

Published
March 30, 2026
Last Modified
March 31, 2026

🔗 CVE IDs covered (1)

CVE-2026-34372 →

📋 Description

Impact

A user which has permission for the Sulu Admin via atleast one role could have access to the subentities of contacts via the admin API without even have permission for contacts.

Patches

The issue was patched in release 2.6.22 and 3.0.5.

Workarounds

Create a Symfony Request Listener checking the permissions for the specific roles.

Resources

Github Advisory: https://github.com/sulu/sulu/security/advisories/GHSA-6h7h-m7p5-hjqp

🎯 Affected products2

  • composer/sulu/sulu:>= 1.0.0, < 2.6.22
  • composer/sulu/sulu:>= 3.0.0, < 3.0.5

🔗 References (5)