What is CVE-2026-82394?
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php do not enforce VIEW permission for the target resource in PreviewLinkManager::generate() or PreviewLinkManager::revoke(). An authenticated administration user who knows a target resource identifier can create or revoke a preview link for any page, article, or snippet, including content in a webspace or area the user cannot view. A generated preview URL is public and resolves content by an opaque token, allowing the user or anyone receiving the link to read restricted content without authentication. This issue is fixed in versions 2.6.25 and 3.0.8.
The record classifies CVE-2026-82394 under weakness classes CWE-862, CWE-863. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 35 days ago.
Severity and exploitation probability
- CVSS v4.0 base score
- 5.3 — Medium (derived from score)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - EPSS (FIRST)
- 0.3% probability of exploitation in the next 30 days, higher than 24.5% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 3.6/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2026-08-31
Is CVE-2026-82394 being exploited?
It currently carries a trending score of 36 in the Threadlinqs vulnerability feed.
Affected products and versions
- sulu: sulu
How to fix CVE-2026-82394
No vendor patch reference has been recorded for CVE-2026-82394 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.
Threat activity tracking CVE-2026-82394
No threat campaign in the Threadlinqs corpus currently references CVE-2026-82394, in its CVE list or as an indicator. The linkage is recomputed from the live corpus on every daily ingest, so this section fills in as soon as a tracked campaign cites the identifier.
Sources
Enriched from CVE.org, NVD, FIRST EPSS. Last verified by Threadlinqs on . This product uses the NVD API but is not endorsed or certified by the NVD.