What is the CVSS score of CVE-2026-86777?

CVE-2026-86777 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-86777?

Yes, a patch is available for CVE-2026-86777. Update the affected software to the latest version immediately.

AlchemyCMS CVE-2026-86777

EUVD-2026-74789 MEDIUM

Missing Authorization (CWE-862)

2026-09-09 VulnCheck

GHSA-wqff-85p9-hwc3

Information Disclosure Alchemy Cms

6.9

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify exposed AlchemyCMS instance
Delivery

Send unauthenticated GET /api/nodes request
Exploit

Receive full navigation node JSON across all sites and languages
Execution

Enumerate restricted page names and internal URL paths
Impact

Target further reconnaissance or attacks against disclosed paths

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation against default configurations of AlchemyCMS. The GET /api/nodes endpoint is part of the standard API layer and requires no authentication token, session cookie, or special headers. The impact is scoped to navigation metadata (page names, URL slugs, internal paths across all sites and languages); instances with no restricted or member-only pages expose correspondingly less sensitive data. Only AlchemyCMS 7.x before 7.4.16 and 8.x before 8.3.6 are confirmed affected; earlier branches are not addressed by the referenced advisory.
Impact	The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N) reflects zero-barrier remote unauthenticated access with no attack complexity, consistent with the trivial exploitation path. Real-world impact is bounded to confidentiality of navigation metadata - page names, URL slugs, and internal site paths - rather than credentials, files, or PII. The VC:L rating is appropriate. For vanilla public-facing sites this is low-severity in practice, but multi-tenant deployments or member-portal configurations where restricted section URLs are intentionally hidden from anonymous users face meaningful reconnaissance exposure. No KEV listing exists and no public POC was identified; EPSS data was not provided in the input. The ease of exploitation (AV:N, AC:L, PR:N, UI:N) elevates practical urgency for any deployment relying on URL obscurity as a control.
Exploit ScenarioDerived	An attacker sends a single unauthenticated HTTP GET request to https://target-site.example/api/nodes on an exposed AlchemyCMS instance and receives a JSON response listing every navigation node across all sites and languages, including names and URL paths of restricted member-only or draft pages. The attacker then uses the disclosed internal URL structure to probe those restricted sections directly or to craft more targeted phishing or injection attempts against known page paths.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 09, 2026

Unauthenticated information disclosure in AlchemyCMS affects all 7.x versions before 7.4.16 and all 8.x versions before 8.3.6 via the GET /api/nodes REST endpoint, which returned the full navigation node dataset without any authorization check. Any network-reachable attacker could enumerate restricted page names, internal URL paths, and cross-site navigation structures across all languages. No public exploit identified at time of analysis, but the attack requires only a single unauthenticated HTTP request, making automated scanning trivial.

RemediationAI

Vendor-released patches are available: upgrade AlchemyCMS to v7.4.16 (7.x branch) or v8.3.6 (8.x branch) from https://github.com/AlchemyCMS/alchemy_cms/releases. The GitHub Security Advisory GHSA-wppq-8h64-w78r at https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-wppq-8h64-w78r provides full details. If an immediate upgrade is not possible, operators can apply a reverse-proxy rule (e.g., nginx deny on location /api/nodes for unauthenticated requests) as a temporary compensating control, accepting that this also blocks legitimate guest-visible navigation API calls and may break frontend navigation features that rely on this endpoint.

Affected VersionsENISA

alchemy_cms 8.0.0 <8.3.6

alchemy_cms 0 <7.4.16

Affected Packages

euvd alchemy_cms fix: 7.4.16, 8.3.6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

AlchemyCMS is a Ruby on Rails CMS (CPE: cpe:2.3:a:alchemycms:alchemy_cms) that exposes a JSON API layer for its frontend. The root cause is CWE-862 (Missing Authorization): the nodes controller at app/controllers/alchemy/api/nodes_controller.rb called Node.all unconditionally, entirely bypassing the CMS's CanCanCan-based permission model. The fix replaces this with Node.accessible_by(current_ability, :index), which routes through CanCanCan's query interface. Three new ActiveRecord scopes were introduced - from_current_public_site, available_to_guests, and available_to_members - and corresponding permission rules were wired into the permissions model so that anonymous guests see only external-link nodes and nodes attached to published, unrestricted pages, authenticated members also see restricted-page nodes, and admin users retain full access.

Know when Alchemy Cms gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI 5.3 MEDIUM

Network-accessible endpoint requires no authentication (AV:N, PR:N, AC:L); only navigation metadata is disclosed (C:L); no integrity or availability impact confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.

Threat Intelligence Overview

EPSS Score

0.4%

Top 65% exploitable

Prevalence

Low

niche Ruby on Rails CMS, limited enterprise deployment footprint

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +34

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.