Description
AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.
Published: 2026-09-09
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

AlchemyCMS releases older than 7.4.16 and any 8.x before 8.3.6 permit unauthenticated access to GET /api/nodes. The endpoint returns all navigation nodes, revealing page names, URL paths, and internal URLs for every site and language. This enables attackers to uncover sensitive site structure data, supporting further reconnaissance.

Affected Systems

The flaw affects AlchemyCMS, a Ruby on Rails based CMS. Systems running any version before 7.4.16 or any 8.x before 8.3.6 are impacted. Upstream patches are available in releases 7.4.16 and 8.3.6.

Risk and Exploitability

CVSS base score of 6.9 indicates medium severity. EPSS is not published, so the probability of exploitation is unclear, but the lack of authentication makes the attack vector trivial once the API is exposed. The flaw is not listed in CISA KEV, suggesting no known active exploitation but still worthy of prompt remediation.

Generated by OpenCVE AI on September 9, 2026 at 11:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade AlchemyCMS to version 7.4.16 or newer, or 8.3.6 or newer, to apply the authorization fix.
  • If upgrading immediately is not possible, restrict the GET /api/nodes endpoint to authenticated users by adding an authentication filter or access control rule in the application or web server configuration.
  • Deploy a web application firewall or reverse proxy to block unauthenticated requests to /api/nodes until the patch can be applied, optionally requiring an API key or token.

Generated by OpenCVE AI on September 9, 2026 at 11:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 10:15:00 +0000

Type Values Removed Values Added
Description AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.
Title AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes
First Time appeared Alchemy-cms
Alchemy-cms alchemy Cms
Weaknesses CWE-862
CPEs cpe:2.3:a:alchemy-cms:alchemy_cms:*:*:*:*:*:*:*:*
Vendors & Products Alchemy-cms
Alchemy-cms alchemy Cms
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Alchemy-cms Alchemy Cms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-09T14:04:34.359Z

Reserved: 2026-09-08T11:35:02.618Z

Link: CVE-2026-86777

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-09T10:22:34.117

Modified: 2026-09-09T10:22:34.117

Link: CVE-2026-86777

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-09T12:00:08Z

Weaknesses