GHSA-9m6v-8fxc-4r44 Sulu: Used API Keys may be available via Admin API
Logged-in users with specific permissions can view project API keys via the admin API if the field is exposed, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-9m6v-8fxc-4r44?
GHSA-9m6v-8fxc-4r44 is a vulnerability in sulu/sulu, published on 18 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Impact
The users endpoint controller exposes a project's apiKey field to the logged-in user, provided they have permission for that endpoint. This only has impact if a project itself uses that specific field, Sulu itself does nothing with it and has no authentication per apiKey in its core.
Patches
A patch is released with Version 2.6.23 and 3.0.5.
Workarounds
Remove the field descriptor by patch the UserController.php File in Sulu Security Bundle.
Which versions are affected by GHSA-9m6v-8fxc-4r44?
4 open source packages ship an affected version, including sulu/sulu.
| Package | Affected | Fixed in |
|---|---|---|
sulu/sulu Packagist | All versions | 2.6.23 |
sulu/sulu Packagist | All versions | 2.6.23 |
sulu/sulu Packagist | From 3.0.0-alpha1 | 3.0.6 |
sulu/sulu Packagist | From 3.0.0-alpha1 | 3.0.6 |
How do I fix GHSA-9m6v-8fxc-4r44?
Upgrade sulu/sulu to a fixed version for your release line: 2.6.23 or 3.0.6.
Is GHSA-9m6v-8fxc-4r44 being exploited?
There is no known exploitation of GHSA-9m6v-8fxc-4r44 in the wild and no public exploit code.