CVE-2026-57579
Received Received - Intake

Unauthenticated Page Tree Exposure in Alchemy CMS

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-57579
EUVD
EUVD-2026-77637

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
alchemycms alchemy_cms 7.4.15
alchemycms alchemy_cms 8.0.15
alchemycms alchemy_cms 8.1.14
alchemycms alchemy_cms 8.2.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects AlchemyCMS versions prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6. An unauthenticated GET request to the /api/pages/nested endpoint returns the full page tree, including restricted and unpublished pages. Adding ?elements=true exposes element content from these restricted pages, bypassing access controls enforced by other endpoints like /api/pages/show.

Detection Guidance

Check if your AlchemyCMS version is below 7.4.15, 8.0.15, 8.1.14, or 8.2.6 by inspecting the Gemfile.lock or running bundle show alchemy_cms. Test the endpoint /api/pages/nested with curl commands like: curl -v http://yourdomain.com/api/pages/nested and curl -v http://yourdomain.com/api/pages/nested?elements=true to see if restricted or unpublished pages are exposed.

Impact Analysis

Unauthorized users can access sensitive page metadata, draft content, and restricted elements without authentication. This could lead to data leaks, unauthorized content exposure, or information disclosure. The high CVSS score (7.5) reflects the potential for significant impact due to unauthorized data access.

Compliance Impact

This vulnerability could lead to unauthorized access to restricted and unpublished page content, including sensitive data. This may violate GDPR's data protection principles (Article 5) and HIPAA's access control requirements (45 CFR § 164.312(a)(1)), as unauthorized individuals could view protected information without proper authorization.

Mitigation Strategies

Upgrade AlchemyCMS to version 7.4.15, 8.0.15, 8.1.14, or 8.2.6 or later immediately. If upgrading is not possible, restrict access to the /api/pages/nested endpoint via firewall rules or web server configuration until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57579. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart