Alchemy: Unauthenticated nested page API leaks restricted & unpublished content
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AlchemyCMS | alchemy_cms | before 7.4.15; 8.0.0 to before 8.0.15; 8.1.0 to before 8.1.14; 8.2.0 to before 8.2.6 | 7.4.15, 8.0.15, 8.1.14, 8.2.6 | Patch available | CNA |
- alchemy_cms VendorAlchemyCMS Affected before 7.4.15; 8.0.0 to before 8.0.15; 8.1.0 to before 8.1.14; 8.2.0 to before 8.2.6 Fixed in 7.4.15, 8.0.15, 8.1.14, 8.2.6 Patch available CNA
Remediation
- Fix · CNA alchemy_cms (AlchemyCMS) Fixed in 7.4.15, 8.0.15, 8.1.14, 8.2.6
Timeline
- 2026-10-02 Threatist record created from CVE-2026-57579
- 2026-10-18 EPSS moved to the 50th–90th percentile
References
Other 11
- https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh
- https://github.com/AlchemyCMS/alchemy_cms/pull/3982
- https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3
- https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99
- https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f
- https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af853e83b4a3a
- https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db01987d0de807f
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6
More AlchemyCMS vulnerabilities
- TI-2026-59334 AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes CVSS 4.0MEDIUM 6.9
- TI-2026-19243 AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper CVSS 3.1CRITICAL 9.9
- TI-2018-12927 A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the… CVSS 3.0MEDIUM 6.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences