EUVD-2026-77637Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network endpoint with no user interaction and no preconditions, but strictly a confidentiality leak of restricted content.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.
AnalysisAI
Alchemy CMS versions prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6 expose an unauthenticated API endpoint (GET /api/pages/nested) that returns the complete page tree without any authorization check, leaking restricted (member-only) and unpublished draft page metadata to anonymous callers. Appending the elements=true parameter causes PageTreeSerializer to additionally dump element and ingredient content from those restricted pages, fully bypassing the access control enforced by the sibling show and index actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default Alchemy CMS installations that expose the JSON API and route GET /api/pages/nested (CVSS PR:N/UI:N/AC:L, confirmed by the GHSA reproduction using a bare curl with no session). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) describes an unauthenticated, low-complexity, network-reachable confidentiality-only disclosure, and the input confirms PR:N, so no credentials are required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the vendor-fixed release for your branch: 7.4.15, 8.0.15, 8.1.14, or 8.2.6 - these are published release tags linked from the advisory (https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh), with the code fix in PR https://github.com/AlchemyCMS/alchemy_cms/pull/3982 and commits 30888fb, 5620e76, 8417a2e, 85702d9, a082dd0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Alchemy Cms
View allA Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field. Rated
Unauthenticated information disclosure in AlchemyCMS affects all 7.x versions before 7.4.16 and all 8.x versions before
Arbitrary code execution in Alchemy CMS before versions 7.4.12 and 8.0.3 stems from unsafe use of Ruby's eval() function
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today