PT-2026-29166 · Symfony+1 · Symfony+1

Sh4Dowalker · Published 2026-03-30 · Updated 2026-04-01 · CVE-2026-34372

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Sulu versions 1.0.0 through 2.6.21 Sulu versions 3.0.0 through 3.0.4

Description Sulu is a PHP content management system built on the Symfony framework. A user with permission to access the Sulu Admin interface, through at least one role, could access sub-entities of contacts via the admin API even without explicit permission for contacts. This occurs due to insufficient permission checks when accessing contact-related data through the admin API. The admin API endpoint is susceptible to unauthorized data access. The vulnerable parameter is not specified.

Recommendations Update to Sulu version 2.6.22 or later. Update to Sulu version 3.0.5 or later. Create a Symfony Request Listener to verify permissions for specific roles.

Exploit

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-34372

GHSA-6H7H-M7P5-HJQP

Affected Products

Sulu

Symfony

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34372.json · Exploit
• https://github.com/sulu/sulu/security/advisories/GHSA-6h7h-m7p5-hjqp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34372 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34372 · Security Note
• https://osv.dev/vulnerability/GHSA-6h7h-m7p5-hjqp · Vendor Advisory
• https://github.com/sulu/sulu · Note
• https://github.com/sulu/sulu/releases/tag/2.6.22 · Note
• https://github.com/sulu/sulu/releases/tag/3.0.5 · Note
• https://twitter.com/CVEnew/status/2039372137069162619 · Twitter Post
• https://twitter.com/cyberbivash/status/2039100923981504656 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1s8lx07/resumen_diario_de_vulnerabilidades_31032026 · Reddit Post