TI-2026-41430 CVE-2026-57579
Alchemy: Unauthenticated nested page API leaks restricted & unpublished content
Priority HIGH 72
Alchemy is an open source content management system engine written in Ruby on Rails.
AlchemyCMS
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
AlchemyCMS records in CISA KEVNo AlchemyCMS vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
4 records
TI-2026-59334 CVE-2026-86777 · GHSA-wqff-85p9-hwc3
AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes
Priority HIGH 70
AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes.
TI-2026-19243 CVE-2026-23885 · GHSA-2762-657x-v979
AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper
Priority MEDIUM 43
Alchemy is an open source content management system engine written in Ruby on Rails.
TI-2018-12927 CVE-2018-18307
A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the…
Priority LOW 31
A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field.