CVE-2026-86777: Missing Authorization in AlchemyCMS alchemy_cms
Affects AlchemyCMS alchemy_cmsSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 45% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| AlchemyCMSalchemy_cms | Affected
| Fixed in
|
RubyGemsalchemy_cmspkg:gem/alchemy_cmsOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Since no official remediation level or patch links are provided, users should monitor the vendor's announcements for updates and apply any official fixes once available. Until then, consider restricting access to the /api/nodes endpoint via network controls or authentication proxies as a temporary mitigation.
Description
AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.
Impact
The vulnerability enables unauthenticated attackers to obtain sensitive information about site navigation structure, including restricted page names and internal URLs. This information disclosure could aid attackers in further reconnaissance or targeted attacks but does not directly allow modification or deletion of data.
Summary
CVE-2026-86777 is a missing authorization vulnerability in AlchemyCMS affecting versions prior to 7.4.16 and 8.x prior to 8.3.6. The vulnerability allows unauthenticated attackers to access the GET /api/nodes endpoint without proper authorization, enabling disclosure of all navigation nodes including restricted page names, URL paths, and internal URLs for all sites and languages managed by the CMS.
References
- github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-wppq-8h64-w78r (opens in a new tab)
- github.com/AlchemyCMS/alchemy_cms/commit/5e2cd16a806c9d2df3eb6e3c889402487e0085b6 (opens in a new tab)
- github.com/AlchemyCMS/alchemy_cms/commit/9bdb98496d6f17277ed05dd1abc3188f880aa554 (opens in a new tab)
- github.com/AlchemyCMS/alchemy_cms/blob/v8.3.5/app/controllers/alchemy/api/nodes_controller.rb (opens in a new tab)
- github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.6 (opens in a new tab)
- github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.16 (opens in a new tab)
- github.com/AlchemyCMS/alchemy_cms (opens in a new tab)
- vulncheck.com/advisories/alchemycms-before-7.4.16-and-8-x-before-8.3.6-missing-authorization-on-get-api-nodes (opens in a new tab)