CVE-2026-86777: AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes
AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AlchemyCMSto a version that resolves this vulnerability.Fixed in 7.4.16 - Upgrade
Upgrade
AlchemyCMSto a version that resolves this vulnerability.Fixed in 8.3.6
Event History
Frequently Asked Questions
Which deployments are affected?
AlchemyCMS versions before 7.4.16 and 8.x versions before 8.3.6 are affected. The exposed endpoint can disclose navigation nodes from all sites and languages.
What does an attacker need to exploit this issue?
An attacker only needs network access to the GET /api/nodes endpoint. No authentication, privileges, or user interaction are required.
What information can be exposed?
Unauthenticated requests can retrieve all navigation nodes, including restricted page names, URL paths, and internal URLs.