CVE-2026-82395: Sulu: Media move/update authorization bypass (IDOR)

A media move authorization bypass (IDOR) lets a backend user move a media out of a collection they have no access to.

The media move endpoint resolves its permission check from the collection value in the request rather than from the media’s real collection. MediaManager::move() then reassigns the media without re-checking its actual source collection. A user who has edit rights on collection A but no rights on a restricted collection B can move a media that lives in B by naming A in the request. The move succeeds, the media ends up in A, and the user can then view and download content they were never allowed to see.

This only affects installations that use per-collection (object level) permissions to restrict some collections. Exploitation requires an authenticated backend user with edit rights on at least one collection, and knowledge of the target media id.