PT-2026-29166 · Symfony+1 · Symfony+1

Sh4Dowalker · Publicado 2026-03-30 · Atualizado 2026-04-01 · CVE-2026-34372

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Sulu versions 1.0.0 through 2.6.21 Sulu versions 3.0.0 through 3.0.4

Description Sulu is a PHP content management system built on the Symfony framework. A user with permission to access the Sulu Admin interface, through at least one role, could access sub-entities of contacts via the admin API even without explicit permission for contacts. This occurs due to insufficient permission checks when accessing contact-related data through the admin API. The admin API endpoint is susceptible to unauthorized data access. The vulnerable parameter is not specified.

Recommendations Update to Sulu version 2.6.22 or later. Update to Sulu version 3.0.5 or later. Create a Symfony Request Listener to verify permissions for specific roles.

Exploit

Correção

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

CVE-2026-34372

GHSA-6H7H-M7P5-HJQP

Produtos afetados

Sulu

Symfony

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34372.json · Exploit
• https://github.com/sulu/sulu · Nota
• https://github.com/sulu/sulu/security/advisories/GHSA-6h7h-m7p5-hjqp · Aviso do Fabricante
• https://github.com/sulu/sulu/releases/tag/2.6.22 · Nota
• https://github.com/sulu/sulu/releases/tag/3.0.5 · Nota
• https://twitter.com/CVEnew/status/2039372137069162619 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2039100923981504656 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-34372 · Aviso do Fabricante
• https://reddit.com/r/VulnMatter/comments/1s8lx07/resumen_diario_de_vulnerabilidades_31032026 · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34372 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-6h7h-m7p5-hjqp · Aviso do Fabricante