Medium severity · published Sep 9, 2026
CVE-2026-86777
AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AL
alchemy_cms · AlchemyCMS
before 7.4.16; 8.0.0 before 8.3.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86777
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86777
github.com
https://github.com/AlchemyCMS/alchemy_cms
github.com
https://github.com/AlchemyCMS/alchemy_cms/blob/v8.3.5/app/controllers/alchemy/api/nodes_controller.rb
github.com
https://github.com/AlchemyCMS/alchemy_cms/commit/5e2cd16a806c9d2df3eb6e3c889402487e0085b6
github.com
https://github.com/AlchemyCMS/alchemy_cms/commit/9bdb98496d6f17277ed05dd1abc3188f880aa554
github.com
https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.16
github.com
https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.6
More from alchemy_cms
9.9
CVE-2026-23885
AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper
7.5
CVE-2026-57579
Alchemy: Unauthenticated nested page API leaks restricted & unpublished content