Log in Start free

Vulnerability · Published Sep 14, 2026 · Assigned by GitHub_M

CVE-2026-57579Alchemy: Unauthenticated nested page API leaks restricted & unpublished content

High 7.5

In plain English

A high-severity missing authorization in alchemy_cms from AlchemyCMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 48.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
RubyGemsalchemy_cms8.2.6GHSA-mqq5-j7w8-2hgh
RubyGemsalchemy_cms8.1.14GHSA-mqq5-j7w8-2hgh
RubyGemsalchemy_cms8.0.15GHSA-mqq5-j7w8-2hgh
RubyGemsalchemy_cms7.4.15GHSA-mqq5-j7w8-2hgh

Affected products (as reported)

VendorProductVersions
AlchemyCMS alchemy_cms < 7.4.15>= 8.0.0, < 8.0.15>= 8.1.0, < 8.1.14>= 8.2.0, < 8.2.6

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References