{
"id": "GHSA-9m6v-8fxc-4r44",
"aliases": [],
"details": "### Impact\n\nThe users endpoint controller exposes a project's apiKey field to the logged-in user, provided they have permission for that endpoint. This only has impact if a project itself uses that specific field, Sulu itself does nothing with it and has no authentication per apiKey in its core.\n\n### Patches\n\nA patch is released with Version 2.6.23 and 3.0.5.\n\n### Workarounds\n\nRemove the field descriptor by patch the UserController.php File in Sulu Security Bundle.",
"summary": "Sulu: Used API Keys may be available via Admin API",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0-alpha1"
},
{
"fixed": "3.0.6"
}
]
}
],
"package": {
"name": "sulu/sulu",
"ecosystem": "Packagist"
},
"database_specific": {
"last_known_affected_version_range": "<= 3.0.5"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.23"
}
]
}
],
"package": {
"name": "sulu/sulu",
"ecosystem": "Packagist"
},
"database_specific": {
"last_known_affected_version_range": "<= 2.6.22"
}
}
],
"modified": "2026-05-18T17:34:06Z",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"published": "2026-05-18T17:34:06Z",
"references": [
{
"url": "https://github.com/sulu/sulu/security/advisories/GHSA-9m6v-8fxc-4r44",
"type": "WEB"
},
{
"url": "https://github.com/sulu/sulu",
"type": "PACKAGE"
},
{
"url": "https://github.com/sulu/sulu/releases/tag/2.6.23",
"type": "WEB"
},
{
"url": "https://github.com/sulu/sulu/releases/tag/3.0.6",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "LOW",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2026-05-18T17:34:06Z"
}
}