Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00467.

Exploitation poc

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
AlchemyCMS alchemy_cms affected
Version Status Constraints
< 7.4.15 affected —
>= 8.0.0, < 8.0.15 affected —
>= 8.1.0, < 8.1.14 affected —
>= 8.2.0, < 8.2.6 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Alchemy-cms Subscribe
Alchemy Cms Subscribe

Project Subscriptions

Vendors Products
Alchemy-cms Subscribe
Alchemy Cms Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3 cve-icon cve-icon
https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99 cve-icon cve-icon
https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f cve-icon cve-icon
https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af853e83b4a3a cve-icon cve-icon
https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db01987d0de807f cve-icon cve-icon
https://github.com/AlchemyCMS/alchemy_cms/pull/3982 cve-icon cve-icon
https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15 cve-icon cve-icon
https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15 cve-icon cve-icon
https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14 cve-icon cve-icon
https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6 cve-icon cve-icon
https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh cve-icon cve-icon cve-icon
History

Tue, 15 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 05:45:00 +0000

Type Values Removed Values Added
First Time appeared Alchemy-cms
Alchemy-cms alchemy Cms
Vendors & Products Alchemy-cms
Alchemy-cms alchemy Cms

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.
Title Alchemy: Unauthenticated nested page API leaks restricted & unpublished content
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-14T17:40:12.109Z

Reserved: 2026-06-24T18:49:56.208Z

Link: CVE-2026-57579

cve-icon Vulnrichment

Updated: 2026-09-14T17:39:56.953Z

cve-icon NVD

Status : Received

Published: 2026-09-14T17:17:49.267

Modified: 2026-09-14T18:17:58.063

Link: CVE-2026-57579

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T13:00:17Z

Weaknesses