CVE-2026-82395

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and...

CVE-2026-82395

CVE-2026-82395 is an IDOR (authorization bypass) in Sulu , an open-source PHP CMS built on Symfony. Prior to versions 2.6.25 and 3.0.8 , the media move endpoint (MediaManager::move() in MediaManager.php) derives its permission check from the client-supplied collection rather than the media item's...

CVE-2026-82395 Sulu: Media move/update authorization bypass (IDOR)

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and...

PT-2026-84047

Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description An issue exists in the media move endpoint where permission checks are derived from the client-supplied collection value rather than the actual source collection of the med...