EUVD-2026-77637Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRecon target Alchemy-hosted site
-
DeliverySend unauthenticated GET /api/pages/nested
-
ExploitMissing authorize! returns full page tree
-
ExecutionEnumerate restricted and unpublished page metadata
-
PersistAppend ?elements=true for content dump
-
ImpactExfiltrate gated/draft editorial content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default Alchemy CMS installations that expose the JSON API and route GET /api/pages/nested (CVSS PR:N/UI:N/AC:L, confirmed by the GHSA reproduction using a bare curl with no session). The only prerequisite is that a restricted (member-only) or unpublished/draft page exists in the tree for the response to disclose; element and ingredient content beyond metadata additionally requires supplying the elements=true query parameter. Limiting factors: the leak is read-only (C:H, I:N, A:N) and does not modify or publish pages; the nested action with an explicit page_id pointing at a restricted page correctly returns HTTP 403 per the advisory's tests, so the over-exposure applies to whole-tree enumeration rather than direct ID access; and fixed builds 7.4.15/8.0.15/8.1.14/8.2.6 remove the exposure entirely. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) describes an unauthenticated, low-complexity, network-reachable confidentiality-only disclosure, and the input confirms PR:N, so no credentials are required. SSVC rates Exploitation as 'poc' with Automatable: yes and Technical Impact: partial, meaning the reproduction is trivial (a single curl command per the GHSA) but the impact is bounded to information disclosure rather than integrity or availability loss. No CISA KEV entry and no EPSS score were provided in the input, so active widespread exploitation cannot be confirmed; the practical priority is driven by the sensitivity of unpublished/restricted content in a given deployment rather than by evidence of mass scanning. Note the data gap: exploitation is POC-confirmed but KEV/EPSS telemetry is absent, so treat the real-world exploitation rate as unverified. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a single GET request to https://target/api/pages/nested on an Alchemy-powered site and receives the full page tree, including member-only and unpublished pages; appending ?elements=true returns the actual editorial content of those hidden pages. The attacker can then enumerate forthcoming announcements, gated content, or internal drafts, and use page IDs/slugs from the response to target further endpoints. No credentials, user interaction, or timing conditions are required, and the SSVC 'automatable: yes' rating means the request can be scripted across many hosts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Alchemy CMS versions prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6 expose an unauthenticated API endpoint (GET /api/pages/nested) that returns the complete page tree without any authorization check, leaking restricted (member-only) and unpublished draft page metadata to anonymous callers. Appending the elements=true parameter causes PageTreeSerializer to additionally dump element and ingredient content from those restricted pages, fully bypassing the access control enforced by the sibling show and index actions. The vendor advisory includes working reproduction steps, and SSVC records that proof-of-concept exploitation is available and automatable, though no CISA KEV listing or EPSS score was supplied.
RemediationAI
Upgrade to the vendor-fixed release for your branch: 7.4.15, 8.0.15, 8.1.14, or 8.2.6 - these are published release tags linked from the advisory (https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh), with the code fix in PR https://github.com/AlchemyCMS/alchemy_cms/pull/3982 and commits 30888fb, 5620e76, 8417a2e, 85702d9, a082dd0. The patch adds authorize! :show to the nested action, scopes PageTreePreloader descendants via accessible_by(ability, :read), and gates serializer output with can?(:read, page). If an immediate upgrade is not possible, block or require authentication on the /api/pages/nested route at the reverse proxy or Rails routing layer (side effect: legitimate API consumers using that endpoint break), or disable the entire Alchemy JSON API namespace if no client depends on it (side effect: any external integration using /api/pages/* stops working). Verify after remediation that anonymous GET /api/pages/nested no longer contains "restricted":true or "public":false entries and that ?elements=true returns no element bodies from restricted pages.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in rubygems
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Alchemy is an open-source content management engine built on Ruby on Rails, exposed via a Rubygems package (rubygems/alchemy_cms, CPE cpe:2.3:a:alchemycms:alchemy_cms). The flaw is CWE-862 Missing Authorization: Api::PagesController#nested (app/controllers/alchemy/api/pages_controller.rb) calls neither authorize! nor accessible_by, unlike the show action (authorize! :show) and index action (accessible_by(current_ability, :index)). PageTreePreloader loaded page.self_and_descendants unfiltered and PageTreeSerializer emitted every page's metadata and, when elements=true was passed, public_version.elements and their ingredients, with no CanCan ability check. The upstream fix threads a CanCan::Ability through the controller, preloader (accessible_by(ability, :read)), and serializer (can?(:read, page)), and replaces the admin_includes flag with an ability-based check for the :locker association.
Know when Alchemy Cms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network endpoint with no user interaction and no preconditions, but strictly a confidentiality leak of restricted content.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.
Technical POC Analysis
CWE-862 (Missing Authorization) in Api::PagesController#nested, app/controllers/alchemy/api/pagescontroller.rb:28, in the alchemycms Ruby gem (Rails engine).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Alchemy Cms
View allA Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field. Rated
Unauthenticated information disclosure in AlchemyCMS affects all 7.x versions before 7.4.16 and all 8.x versions before
Arbitrary code execution in Alchemy CMS before versions 7.4.12 and 8.0.3 stems from unsafe use of Ruby's eval() function
Exploit-DB