CVEvulnerability
CVE-2026-86777
6.9 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-09-09
- Last modified
- 2026-09-10
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 6.9 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-862
Description
AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://github.com/AlchemyCMS/alchemy_cms github.com
- https://github.com/AlchemyCMS/alchemy_cms/blob/v8.3.5/app/controllers/alchemy/api/nodes_controller.rb github.com
- https://github.com/AlchemyCMS/alchemy_cms/commit/5e2cd16a806c9d2df3eb6e3c889402487e0085b6 github.com
- https://github.com/AlchemyCMS/alchemy_cms/commit/9bdb98496d6f17277ed05dd1abc3188f880aa554 github.com
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.16 github.com
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.6 github.com
- https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-wppq-8h64-w78r github.com
- https://www.vulncheck.com/advisories/alchemycms-before-7.4.16-and-8-x-before-8.3.6-missing-authorization-on-get-api-nodes www.vulncheck.com
- https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-wppq-8h64-w78r github.com