CVE-2026-82394: Sulu Fix Authorization Bypass When Creating Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-65cv-w493-7vhq",
  "modified" : "2026-09-02T15:09:33Z",
  "published" : "2026-09-02T15:09:33Z",
  "aliases" : [ "CVE-2026-82394" ],
  "summary" : "Sulu: Fix authorization bypass when creating preview links",
  "details" : "### Impact\n\nA missing authorization check on the preview link endpoint lets a backend user create a public, unauthenticated preview URL for content they are not allowed to see.\n\n`PreviewLinkController` (and the underlying `PreviewLinkManager::generate()` / `revoke()`) never enforced a permission on the target resource. Any authenticated administration user could call the generate action for any page, article or snippet, including content in a webspace or area they have no VIEW rights on. The endpoint returns a public render URL that resolves the content solely by an opaque token, so the attacker (or anyone they share the link with) can then read the restricted content without authentication.\n\nThis affects installations that use Sulu role and webspace permissions to restrict who may see certain content. Exploitation requires an authenticated backend user and the id of the target resource.\n\n### Patches\n\nFixed in **2.6.x** and **3.0.x**. `PreviewLinkManager::generate()` and `revoke()` now resolve the resource's security context and enforce a VIEW permission check before a preview link is created or removed. A user without VIEW access on the resource receives a 403 response and no link is created.\n\nNote on scope: this patch closes the authorization bypass. Two related hardening items from the original report are tracked as a separate follow-up because they require a database migration:\n\n- The preview link token is derived from `substr(md5(uuid), 0, 12)` (about 48 bits of entropy).\n- Preview links never expire.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- Restrict backend access so that only trusted users can reach the administration interface.\n- Apply the fix manually by adding a VIEW permission check (via `SecurityCheckerInterface` and the resource's security context) inside `PreviewLinkManager::generate()` and `revoke()`.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "sulu/sulu"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.6.25"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.6.24"
    }
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "sulu/sulu"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0-alpha1"
      }, {
        "fixed" : "3.0.8"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/sulu/sulu/security/advisories/GHSA-65cv-w493-7vhq"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-82394"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/sulu/sulu/commit/44d8844c3514a70b769ab791b9530df806240fab"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/sulu/sulu"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/sulu/sulu/releases/tag/2.6.25"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/sulu/sulu/releases/tag/3.0.8"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-862", "CWE-863" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-02T15:09:33Z",
    "nvd_published_at" : "2026-08-31T22:17:22Z"
  }
}