CVE-2026-34372: 
PHP vulnerability analysis and mitigation

CVE-2026-34372 is an authorization bypass vulnerability in the Sulu CMS Admin API that allows authenticated users with any admin role to access contact subentities without having explicit permissions for the contacts module. It affects sulu/sulu versions >= 1.0.0 < 2.6.22 and >= 3.0.0 < 3.0.5. The vulnerability was discovered by researcher sh4dowalker, published by alexander-schranz on March 27, 2026, and added to the GitHub Advisory Database on March 30, 2026. It carries a CVSS v3.1 base score of 2.7 (Low) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Sulu Advisory).

The root cause is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel): the Sulu Admin API fails to enforce contact-specific permissions on subentity endpoints, allowing any authenticated admin user — regardless of their role's actual contact permissions — to reach those endpoints. An attacker with at least one Sulu Admin role can send direct HTTP requests to the admin API's contact subentity endpoints (e.g., addresses, phone numbers, emails associated with contacts) and retrieve data they should not be authorized to view. No special tooling or elevated privileges beyond a basic admin role are required (GitHub Advisory, Sulu Advisory).

Successful exploitation results in unauthorized read access to contact subentity data (such as addresses, phone numbers, and email addresses stored in the CRM-like contacts module) by users who should not have visibility into that data. The impact is limited to confidentiality — there is no integrity or availability impact — and is scoped to the vulnerable Sulu instance without lateral movement potential. Organizations managing sensitive personal or business contact information in Sulu are most at risk of data exposure (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.036% (6th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated session with at least one Sulu Admin role, limiting the attacker pool to internal or compromised admin users (GitHub Advisory).

1. Obtain Admin Access: Acquire credentials for any Sulu Admin user account that has at least one assigned role — this does not require contact-specific permissions.
2. Authenticate to the Admin API: Log in to the Sulu Admin interface or obtain a valid session token/cookie via the Sulu authentication endpoint.
3. Identify Contact Subentity Endpoints: Enumerate the Sulu Admin API to locate contact subentity endpoints (e.g., /admin/api/contacts/{id}/addresses, /admin/api/contacts/{id}/emails, /admin/api/contacts/{id}/phones).
4. Send Unauthorized Requests: Issue HTTP GET requests to these endpoints using the authenticated session. The API will return contact subentity data without checking whether the user's role includes contact permissions.
5. Exfiltrate Data: Collect the returned contact subentity records (addresses, phone numbers, emails) for reconnaissance or data harvesting purposes (GitHub Advisory, Sulu Advisory).

• Network: Unusual or repeated HTTP GET requests to /admin/api/contacts/*/addresses, /admin/api/contacts/*/emails, or /admin/api/contacts/*/phones from admin accounts that do not normally access the contacts module.
• Logs: Sulu application or web server access logs showing contact subentity API calls from user accounts with roles that lack explicit contact permissions; high-volume enumeration of contact IDs in API paths.
• Behavioral: Admin user accounts accessing contact subentity endpoints outside of normal business hours or from unexpected IP addresses.

Upgrade sulu/sulu to version 2.6.22 (for the 2.x branch) or 3.0.5 (for the 3.x branch), both released on March 27, 2026, which include the security fix for GHSA-6h7h-m7p5-hjqp. As a temporary workaround for installations that cannot be immediately upgraded, create a Symfony Request Listener that explicitly checks permissions for the affected contact subentity routes before allowing access. Restricting admin role assignments to only trusted users also reduces exposure (Sulu Advisory, Release 2.6.22, Release 3.0.5).