Access Control Bypass Affecting sulu/sulu package, versions <2.6.23>=3.0.0-alpha1, <3.0.6
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Access Control Bypass vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PHP-SULUSULU-16755476
- published19 May 2026
- disclosed18 May 2026
- creditgangadhar-s-k
Introduced: 18 May 2026
CVE NOT AVAILABLE CWE-284 (opens in a new tab)How to fix?
Upgrade sulu/sulu to version 2.6.23, 3.0.6 or higher.
Overview
sulu/sulu is a highly extensible open-source PHP content management system based on the Symfony framework.
Affected versions of this package are vulnerable to Access Control Bypass in the users endpoint controller, which exposes the apiKey field to logged-in users who have permission for that endpoint. An attacker can access sensitive API keys by leveraging authorized access to the Admin API. This is only exploitable if a project uses the exposed apiKey field, as the core does not utilize or authenticate per API key.
Workaround
This vulnerability can be mitigated by removing the field descriptor by patching the UserController.php file in the Sulu Security Bundle.