CVE-2026-34372 PUBLISHED

Sulu checks fix permissions for subentities endpoints

Assigner: GitHub_M
Reserved: 27.03.2026 Published: 31.03.2026 Updated: 31.03.2026

Sulu is an open-source PHP content management system based on the Symfony framework. From versions 1.0.0 to before 2.6.22, and 3.0.0 to before 3.0.5, a user which has permission for the Sulu Admin via at least one role could have access to the sub-entities of contacts via the admin API without even have permission for contacts. This issue has been patched in versions 2.6.22 and 3.0.5.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	Low	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	sulu
Product	sulu
Versions	Version >= 1.0.0, < 2.6.22 is affected Version >= 3.0.0, < 3.0.5 is affected

References

Problem Types

CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE