CVE-2026-86777: AlchemyCMS Information Disclosure Flaw

CVE-2026-86777 Overview

CVE-2026-86777 is a missing authorization vulnerability [CWE-862] in AlchemyCMS, a Ruby on Rails content management system. The GET /api/nodes endpoint in AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fails to enforce access control. Unauthenticated attackers can query the endpoint over the network to retrieve every navigation node across all sites and languages. The exposed data includes restricted page names, URL paths, and internal URLs that were intended to be private.

Critical Impact
Unauthenticated remote attackers can enumerate the full navigation tree, including restricted and internal pages, exposing information useful for reconnaissance and follow-on attacks.

Affected Products

AlchemyCMS versions prior to 7.4.16
AlchemyCMS 8.x versions prior to 8.3.6
Deployments exposing the /api/nodes endpoint to untrusted networks

Discovery Timeline

2026-09-09 - CVE-2026-86777 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86777

Vulnerability Analysis

The flaw resides in the Alchemy::Api::NodesController#index action. The controller registers authorize_access only for the move and toggle_folded actions, leaving index unauthenticated and unauthorized. The action returns Node.all, serializing every navigation node stored in the application without filtering by session, role, publication status, or site scope.

An attacker sending an HTTP GET to /api/nodes receives the entire navigation tree in JSON form. Because AlchemyCMS uses nodes to represent both public and restricted page structures, the response can leak the existence and paths of pages that were intended to be hidden from anonymous visitors.

The issue is classified under [CWE-862: Missing Authorization]. While confidentiality impact is limited to page metadata rather than page bodies, disclosed URLs and titles frequently reveal administrative interfaces, staging content, and internal workflows.

Root Cause

The controller trusted request context without asking the authorization layer whether the caller could view each record. The index action bypassed the CanCan accessible_by scope entirely, and the Node model lacked scopes that distinguished guest-visible nodes from restricted ones.

Attack Vector

Exploitation requires only network reachability to the AlchemyCMS application. No credentials, user interaction, or specialized tooling are needed. A single GET request to /api/nodes, optionally filtered with the language_id or filter query parameters, returns the complete navigation dataset.

ruby

# Vulnerable code in app/controllers/alchemy/api/nodes_controller.rb
     before_action :authorize_access, only: [:move, :toggle_folded]
 
     def index
-      @nodes = Node.all
+      @nodes = Node.accessible_by(current_ability, :index)
       @nodes = @nodes.includes(:parent)
       @nodes = @nodes.where(language_id: params[:language_id]) if params[:language_id]
       @nodes = @nodes.ransack(params[:filter]).result.order(:lft)

Source: AlchemyCMS Commit 5e2cd16. The patch replaces the unrestricted Node.all query with Node.accessible_by(current_ability, :index), delegating record filtering to the CanCan ability layer.

Detection Methods for CVE-2026-86777

Indicators of Compromise

Unauthenticated HTTP GET requests to /api/nodes or /api/nodes.json in web server access logs
Requests to /api/nodes from source IPs that never authenticate to the admin interface
Bursts of requests iterating over the language_id parameter values against /api/nodes
Rails production logs showing Alchemy::Api::NodesController#index responses without a current_user context

Detection Strategies

Parse reverse proxy or Rails logs for GET /api/nodes requests and correlate with session cookies to isolate unauthenticated callers.
Alert when the response size for /api/nodes exceeds a baseline consistent with public content, indicating disclosure of restricted nodes.
Compare application version banners or Gemfile.lock inventories against fixed releases 7.4.16 and 8.3.6.

Monitoring Recommendations

Forward AlchemyCMS application and web server logs to a central analytics platform for continuous review of API access patterns.
Track rate and diversity of source IPs querying /api/nodes to identify enumeration attempts.
Maintain an asset inventory of Rails applications embedding AlchemyCMS to ensure coverage during vulnerability sweeps.

How to Mitigate CVE-2026-86777

Immediate Actions Required

Upgrade AlchemyCMS to version 7.4.16 or 8.3.6 or later depending on the branch in use.
Audit web server logs for prior unauthenticated access to /api/nodes and treat disclosed URLs as reconnaissance data.
Review restricted pages whose names or paths may have leaked and rotate any secrets embedded in URLs.

Patch Information

The maintainers released fixed versions AlchemyCMS v7.4.16 and AlchemyCMS v8.3.6. The fix is implemented in commits 5e2cd16 and 9bdb984. Additional detail is available in the GitHub Security Advisory GHSA-wppq-8h64-w78r and the VulnCheck Advisory for AlchemyCMS.

Workarounds

Block or restrict access to /api/nodes at the reverse proxy or web application firewall until the upgrade is applied.
Require authentication on the /api/ path by adding a middleware or Rack constraint in front of the AlchemyCMS engine.
Limit exposure of the AlchemyCMS admin and API surface to trusted networks or VPN clients.

bash

# Nginx example blocking unauthenticated access to the vulnerable endpoint
location = /api/nodes {
    # Restrict to internal network until the application is patched
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://alchemy_backend;
}