CVE-2021-43835

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions Sulu users who have access to any subset of the admin UI are able to elevate their privilege. Over the API it was possible for them to give themselves permissions to areas which they did not already had. This issue was introduced in 2.0.0-RC1 with the new ProfileController putAction. The versions have been patched in 2.2.18, 2.3.8 and 2.4.0. For users unable to upgrade the only known workaround is to apply a patch to the ProfileController manually.

• CWE-269

• https://github.com/sulu/sulu/commit/30bf8b5a4f83b6f2171a696011757d095edaa28aPatch, Third Party Advisory
• https://github.com/sulu/sulu/security/advisories/GHSA-84px-q68r-2fc9Third Party Advisory
• https://github.com/sulu/sulu/commit/30bf8b5a4f83b6f2171a696011757d095edaa28aPatch, Third Party Advisory
• https://github.com/sulu/sulu/security/advisories/GHSA-84px-q68r-2fc9Third Party Advisory

Published

Dec 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4383The WP Quick FrontEnd Editor plugin for WordPress is vulnera…4.3
• CVE-2021-43830OpenProject is a web-based project management software. Open…8.8
• CVE-2021-43831Gradio is an open source framework for building interactive …7.7
• CVE-2021-43832Spinnaker is an open source, multi-cloud continuous delivery…9.8
• CVE-2021-43833eLabFTW is an electronic lab notebook manager for research t…8.8
• CVE-2021-43834eLabFTW is an electronic lab notebook manager for research t…9.8
• CVE-2021-43836Sulu is an open-source PHP content management system based o…8.8
• CVE-2021-43837vault-cli is a configurable command-line interface tool (and…9.1
• CVE-2021-43838jsx-slack is a library for building JSON objects for Slack B…7.5
• CVE-2021-43839Cronos is a commercial implementation of a blockchain. In Cr…7.5
• CVE-2021-4384The WordPress Photo Gallery – Image Gallery plugin for WordP…4.3
• CVE-2021-43840message_bus is a messaging bus for Ruby processes and web cl…6.5