Sulu Permission Bypass Vulnerability in Admin API Contacts Sub-Entities Access

A vulnerability exists in Sulu, an open-source PHP content management system, allowing users with at least one role permission for the Sulu Admin to access sub-entities of contacts through the admin API. This access is granted without the necessary permissions for contacts themselves. The issue affects Sulu versions 1.0.0 prior to 2.6.22, as well as versions 3.0.0 prior to 3.0.5.

Impact

Exploitation of this vulnerability could lead to unauthorized access to contact sub-entities via the admin API, bypassing normal permission checks.

Remediation

Users can upgrade to Sulu versions 2.6.22 or 3.0.5, where this vulnerability has been patched. For those unable to upgrade, a Symfony Request Listener can be created to check permissions for specific roles.