CVE-2026-86777mediumCWE-862

CVE-2026-86777: medium-severity vulnerability in AlchemyCMS alchemy_cms

AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes

Published

Follow this CVE+ Monitor alchemy cms

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.6%
AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
AlchemyCMS · alchemy_cms
Related CVEs — AlchemyCMS alchemy_cms

In the same product, most dangerous first.

CVE-2026-57579HIGHAlchemy: Unauthenticated nested page API leaks restricted & unpublished contentEPSS 0.6%CVE-2026-23885MEDIUMAlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelperEPSS 0.5%