What’s Vulnerable › Vulnerabilities

CVE-2026-86777: AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-09 · updated 2026-09-10
• Weakness: CWE-862

Description

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.

Affected products

• AlchemyCMS alchemy_cms: before 7.4.16; from 8.0.0 before 8.3.6 — fixed in 7.4.16, 8.3.6

How to fix

Upgrade to a fixed version: AlchemyCMS alchemy_cms 7.4.16, 8.3.6. Check the vendor advisory for mitigations.

References

• https://github.com/AlchemyCMS/alchemy_cms
• https://github.com/AlchemyCMS/alchemy_cms/blob/v8.3.5/app/controllers/alchemy/api/nodes_controller.rb
• https://github.com/AlchemyCMS/alchemy_cms/commit/5e2cd16a806c9d2df3eb6e3c889402487e0085b6
• https://github.com/AlchemyCMS/alchemy_cms/commit/9bdb98496d6f17277ed05dd1abc3188f880aa554
• https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.16
• https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.6
• https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-wppq-8h64-w78r
• https://www.vulncheck.com/advisories/alchemycms-before-7.4.16-and-8-x-before-8.3.6-missing-authorization-on-get-api-nodes
• https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-wppq-8h64-w78r

Get alerted when CVE-2026-86777 or the next vulnerability affects your stack