CVE-2026-34372
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In Sulu, an open-source PHP CMS based on Symfony, versions 1.0.0 through 2.6.22 and 3.0.0 through 3.0.5, a user with permission for the Sulu Admin via at least one role could access sub-entities of contacts via the admin API without having permission for contacts.
Risk Assessment
The organization is exposed to unauthorized access to contact data by users with minimal privileges, which could lead to leakage of confidential information.
Recommendation
Update Sulu to version 2.6.22 or 3.0.5 (depending on the branch used), which include a fix for this vulnerability.
Original NVD description (English source)
Sulu is an open-source PHP content management system based on the Symfony framework. From versions 1.0.0 to before 2.6.22, and 3.0.0 to before 3.0.5, a user which has permission for the Sulu Admin via at least one role could have access to the sub-entities of contacts via the admin API without even have permission for contacts. This issue has been patched in versions 2.6.22 and 3.0.5.