CVE-2026-86777
AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.
| CWE | CWE-862 |
| Vendor | alchemycms |
| Product | alchemy_cms |
| Published | Sep 9, 2026 |
| Last Updated | Sep 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for alchemycms alchemy_cms
Be the first to know when new medium vulnerabilities affecting alchemycms alchemy_cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
AlchemyCMS / alchemy_cms
0 < 7.4.16 8.0.0 < 8.3.6
References
github.com: https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-wppq-8h64-w78r github.com: https://github.com/AlchemyCMS/alchemy_cms/commit/5e2cd16a806c9d2df3eb6e3c889402487e0085b6 github.com: https://github.com/AlchemyCMS/alchemy_cms/commit/9bdb98496d6f17277ed05dd1abc3188f880aa554 github.com: https://github.com/AlchemyCMS/alchemy_cms/blob/v8.3.5/app/controllers/alchemy/api/nodes_controller.rb github.com: https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.6 github.com: https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.16 github.com: https://github.com/AlchemyCMS/alchemy_cms vulncheck.com: https://www.vulncheck.com/advisories/alchemycms-before-7.4.16-and-8-x-before-8.3.6-missing-authorization-on-get-api-nodes
Credits
Shohruh Yo'ldoshov