CVE-2026-82395

Executive Summary

CVE-2026-82395 is an authorization bypass vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) in Sulu, an open-source PHP CMS built on the Symfony framework. An authenticated backend user with edit permissions on one collection can abuse the media move endpoint to relocate media items from restricted collections they do not have access to, then view or download those items. The flaw stems from the move endpoint deriving its permission check from a client-supplied collection value rather than the media item's actual source collection, combined with MediaManager::move() failing to verify the source collection. The vulnerability is fixed in Sulu versions 2.6.25 and 3.0.8. No CVSS score, EPSS score, or public exploit code is currently available.

Technical Analysis

The vulnerability resides in the media management module of Sulu CMS, specifically in the media move functionality. Two distinct weaknesses combine to create the authorization bypass:

1. Client-Supplied Permission Source: The media move endpoint evaluates authorization based on the collection identifier provided in the HTTP request body or parameters by the client, rather than retrieving the media item's actual source collection from the data store. This means the permission check is performed against a collection chosen by the attacker, not the collection where the media item physically resides.

2. Missing Source Validation (CWE-639): The file src/Sulu/Bundle/MediaBundle/Media/Manager/MediaManager.php contains the MediaManager::move() method, which performs the item relocation without verifying the source collection of the media item. The method accepts the target media identifier and reassigns it to a new collection without confirming that the authenticated user has permissions on the collection from which the item originated.

The attack surface is the authenticated backend administration interface of Sulu CMS. The vulnerability is reachable by any authenticated user with at least "edit" permission on any single collection. The permission model is per-collection: users can be granted granular access to individual collections, and the system enforces these boundaries during normal media operations (upload, view, download, delete). However, the move operation fails to enforce the same boundaries on the source side.

The exploitation mechanics are straightforward. An attacker who has legitimate access to Collection A (an allowed collection) can craft a request to the media move endpoint specifying a target media identifier belonging to Collection B (a restricted collection) while providing Collection A's identifier as the collection from which the permission check should be derived. The endpoint validates that the user has permissions on Collection A, passes the check, and invokes MediaManager::move() to reassign the media item. Since the move method does not independently verify the source collection, the item is relocated from Collection B to wherever the attacker specifies, thereby breaking the access control boundary.

Once the item is moved into a collection the attacker controls (or has access to), they can view, preview, or download the media content, exposing documents, images, or other files that were protected by the collection-level permission model. The issue also permits broader data exposure: repeated exploitation allows an attacker to systematically enumerate media identifiers and exfiltrate all restricted media items within the system.

Exploitation Scenarios

Scenario 1: Direct Media Exfiltration

1. Reconnaissance/Target Identification: The attacker authenticates to the Sulu backend and identifies a restricted collection (e.g., containing confidential documents) and a collection they can edit. The attacker may use directory enumeration or knowledge of the system to discover media identifiers for items in the restricted collection. Media identifiers are typically numeric database IDs, and adjacent IDs are often predictable.

2. Flaw Trigger: The attacker crafts a POST/GET request to the media move endpoint, supplying the target media identifier (belonging to the restricted collection) and the identifier of the collection they control as the source collection for the permission check.

3. Execution Method: The endpoint performs the authorization check against the client-supplied collection (which the user has rights on), passing validation. MediaManager::move() then executes without independent source verification, reassigning the media item to the attacker's chosen collection.

4. Post-Exploitation Impact: After the move completes, the attacker accesses the media item through the standard media preview/download interface, retrieving content (e.g., PDFs, images, documents) they were not authorized to access. The attacker may repeat this process across multiple media IDs to exfiltrate all restricted content.

Scenario 2: Chained Collection Compromise

1. Reconnaissance: The attacker maps the collection hierarchy and identifies which collections map to which business units or sensitivity levels.

2. Flaw Trigger: The attacker systematically moves media items between collections, not only exfiltrating content but also causing data integrity damage by relocating organizational assets into unauthorized locations.

3. Execution Method: Same as Scenario 1 — the permission check is bypassed using the client-supplied source collection value.

4. Post-Exploitation Impact: Beyond exfiltration, the attacker can cause denial of service or data integrity issues by moving media that other users depend on, breaking application functionality that links to media assets by collection.

Note: No public PoC is available; the attack chain is inferred from the vulnerability class and the technical description provided by the CNA. The description explicitly identifies the flaw as residing in the media move endpoint's permission derivation logic and the MediaManager::move() method's failure to validate the source collection.

Impact Assessment

Business Impact: This vulnerability enables an authenticated backend user to exfiltrate media content beyond their authorized access scope. In enterprise deployments of Sulu CMS, media collections commonly contain sensitive business documents, contractual agreements, intellectual property, internal communications, customer data, and other confidential material. A successful exploit directly impacts data confidentiality and can constitute a data breach under applicable regulations (GDPR, HIPAA, etc.).

Affected Systems: Any Sulu CMS instance running versions prior to 2.6.25 or prior to 3.0.8 that exposes the backend administration interface to authenticated users, including contractors, partners, or employees with limited collection-level permissions. The vulnerability is not remotely exploitable without valid credentials, but given that Sulu is often deployed as a headless CMS, the backend may be exposed to a broader population than intended.

Blast Radius: The exposure scope depends on the number and sensitivity of media assets stored in restricted collections. In multi-tenant deployments or content hub configurations, the blast radius may span multiple business units or external content partners. The vulnerability allows enumeration and bulk exfiltration, significantly amplifying the risk from a single exploitable request.

CVSS Context: No CVSS score has been officially assigned (N/A). Based on the characteristics — authenticated attacker, high complexity in some aspects, no user interaction required, high confidentiality impact — the vulnerability would likely score in the medium-to-high range if assessed, but no official rating exists and shall not be fabricated.

Detection Guidance

Sigma Rule

title: Sulu CMS - Media Move Authorization Bypass
id: 5f9d2a1b-2c4e-4f8a-9b3d-1e2f3a4b5c6d
status: experimental
description: Detects suspicious media move requests in Sulu CMS that may indicate CVE-2026-82395 exploitation. Monitors for requests where a media item is moved from a collection without proper authorization validation.
logsource:
    category: application
    product: sulu
detection:
    selection:
        event.action: media_move
        request.method: POST
        request.uri|contains:
            - '/admin/api/media'
            - '/admin/media'
    condition: selection
    timeframe: 15m
fields:
    - src.ip
    - user.name
    - request.uri
    - request.body
falsepositives:
    - Legitimate media reorganization by administrators
    - Bulk media migration activities
level: medium

YARA Rule

rule Sulu_MediaManager_Authorization_Bypass_CVE_2026_82395 {
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects references to Sulu MediaManager move functionality and collection manipulation patterns associated with CVE-2026-82395"
        cve = "CVE-2026-82395"
        date = "2026-01-01"
    strings:
        $s1 = "MediaManager::move" ascii fullword
        $s2 = "MediaManager" ascii
        $s3 = "src/Sulu/Bundle/MediaBundle/Media/Manager/MediaManager.php" ascii nocase
        $s4 = "moveMedia" ascii nocase
        $s5 = "collectionId" ascii nocase
        $s6 = "mediaId" ascii nocase
    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x4D5A) and  // PE file check
        (1 of ($s1, $s2, $s3) and (any of ($s4, $s5, $s6)))
        or
        (filesize < 500KB and 2 of them)
}

Suricata IDS Rule

alert http any any -> any any (msg:"Sulu CMS - Potential Media Move Authorization Bypass (CVE-2026-82395)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/admin/api/media/"; http.uri; content:"collection"; http.uri; content:"move"; http.request_body; content:"sourceCollection"; nocase; classtype:attempted-admin; reference:cve,2026-82395; sid:202682395; rev:1;)

Elastic Detection

sequence by user.name, src.ip with maxspan=15m
  [network where event.action == "request" and 
   destination.port == 443 and 
   url.path like "*media*" and 
   url.path like "*move*"]
  [network where event.action == "request" and 
   url.path like "*media*" and 
   http.request.body.text like "*collectionId*"]
  [file where event.action == "access" and 
   file.name : "*" and 
   process.name : "php-fpm*" or process.name : "php*"]

Splunk SPL Query

index=webserver sourcetype=access_combined
| where like(uri, "%media%move%") OR like(uri, "%/admin/api/media/%")
| rex field=_raw "POST (?<uri_path>[^\s?]+)"
| search uri_path="/admin/api/media/*"
| stats count by src_ip user uri status
| where count > 5
| eval indicator = "HPS - Possible CVE-2026-82395 Media Move Abuse"
| table _time src_ip user uri status count indicator

Wazuh OSSEC Rule

<group name="sulu,">
  <rule id="100235" level="8">
    <if_sid>31122</if_sid>
    <match>^POST /admin/api/media/.*/move</match>
    <description>Sulu CMS: Possible media move authorization bypass (CVE-2026-82395)</description>
    <group>access_control,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. Although the NVD description states the issue is fixed in versions 2.6.25 and 3.0.8, no patch evidence has been confirmed from tracked sources at this time.

Immediate Mitigations:

1. Restrict Backend Access: Limit access to the Sulu backend administration interface to only trusted personnel. Implement IP allowlisting and require VPN access for administrative functions.
2. Review Collection Permissions: Conduct an immediate audit of all collection-level permissions. Remove "edit" permissions from users who do not require them, minimizing the attack surface.
3. Monitor Media Move Activity: Enable detailed audit logging on the media move endpoint and review logs for anomalous patterns, including bulk move operations or moves involving restricted collections.
4. Temporary Workaround: If feasible, disable media relocation functionality at the web server level (e.g., block requests to /admin/api/media/*/move endpoints) until a full patch is applied.

Patch/Upgrade Steps:

1. Monitor the Sulu security advisory channels for an official patch release.
2. Upgrade to Sulu 2.6.25 or 3.0.8 (if available from official vendor channels) which are stated to contain the fix.
3. Verify the integrity of upgrade packages using vendor-provided checksums before deployment in staging, then production.

Long-Term Hardening:

1. Implement mandatory Content Security Policy (CSP) headers and additional HTTP security hardening on the Sulu backend.
2. Conduct regular penetration testing focused on the media management module and other file-handling functionality.
3. Establish a vulnerability management program that subscribes to Sulu security advisories and applies emergency patches within 48 hours for critical-severity issues.

References

• NVD Entry for CVE-2026-82395: https://nvd.nist.gov/vuln/detail/CVE-2026-82395
• Sulu Official Website: https://sulu.io/
• Sulu GitHub Repository (Security Advisories): https://github.com/sulu/sulu/security/advisories
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-82395: NO — not listed)

Threat Actor Campaigns: No known threat actor campaigns or exploit-in-the-wild evidence exists at the time of this report. The vulnerability is not listed in the CISA KEV catalog.