Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-h6cx-gjxx-v25c
sulu/sulusulu/suluImpact
A media move authorization bypass (IDOR) lets a backend user move a media out of a collection they have no access to.
The media move endpoint resolves its permission check from the collection value in the request rather than from the media's real collection. MediaManager::move() then reassigns the media without re-checking its actual source collection. A user who has edit rights on collection A but no rights on a restricted collection B can move a media that lives in B by naming A in the request. The move succeeds, the media ends up in A, and the user can then view and download content they were never allowed to see.
This only affects installations that use per-collection (object level) permissions to restrict some collections. Exploitation requires an authenticated backend user with edit rights on at least one collection, and knowledge of the target media id.
Patches
Fixed in 2.6.25 and 3.0.8. MediaManager::move() now verifies edit permission on the media's real source collection and on the destination collection before moving it.
Workarounds
If you cannot upgrade immediately:
- Restrict the media edit permission to trusted users, so untrusted users cannot trigger a move.
- Apply the fix manually by adding an edit permission check on the media's real source collection (and the destination) inside
MediaManager::move().
Upload your own SBOM in CycloneDX 1.6 or higher (JSON) directly here to check your vulnerabilities.
Drag and drop some file here, or click to select
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs basic access or low-level privileges. No user interaction is needed for the attacker to exploit this vulnerability.
Limited exploitation activity has been observed. Close monitoring and planned remediation are recommended.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard