CVE-2026-57579 (GCVE-0-2026-57579)

Vulnerability from cvelistv5 – Published: 2026-09-14 16:54 – Updated: 2026-09-14 17:40

Title

Alchemy: Unauthenticated nested page API leaks restricted & unpublished content

Summary

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 17:39 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root Scorecard

References

11 references

URL	Tags
https://github.com/AlchemyCMS/alchemy_cms/securit…	x_refsource_CONFIRM
https://github.com/AlchemyCMS/alchemy_cms/pull/3982	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/commit/…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/release…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/release…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/release…	x_refsource_MISC
https://github.com/AlchemyCMS/alchemy_cms/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
AlchemyCMS	alchemy_cms	Affected: < 7.4.15 Affected: >= 8.0.0, < 8.0.15 Affected: >= 8.1.0, < 8.1.14 Affected: >= 8.2.0, < 8.2.6	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57579",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T17:39:44.487415Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T17:40:12.109Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "alchemy_cms",
          "vendor": "AlchemyCMS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.4.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.0.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.1.0, \u003c 8.1.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.0, \u003c 8.2.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller\u0027s ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T16:54:19.932Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/pull/3982",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/pull/3982"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af853e83b4a3a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af853e83b4a3a"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db01987d0de807f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db01987d0de807f"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14"
        },
        {
          "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6"
        }
      ],
      "source": {
        "advisory": "GHSA-mqq5-j7w8-2hgh",
        "discovery": "UNKNOWN"
      },
      "title": "Alchemy: Unauthenticated nested page API leaks restricted \u0026 unpublished content"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57579",
    "datePublished": "2026-09-14T16:54:19.932Z",
    "dateReserved": "2026-06-24T18:49:56.208Z",
    "dateUpdated": "2026-09-14T17:40:12.109Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-57579",
      "date": "2026-10-04",
      "epss": "0.00648",
      "percentile": "0.49244"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "alchemy_cms",
                "vendor": "AlchemyCMS",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 7.4.15"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 8.0.0, \u003c 8.0.15"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 8.1.0, \u003c 8.1.14"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 8.2.0, \u003c 8.2.6"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller\u0027s ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6."
          }
        ],
        "id": "CVE-2026-57579",
        "lastModified": "2026-09-30T19:57:08.043",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-57579",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T17:39:44.487415Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-14T17:17:49.267",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af853e83b4a3a"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db01987d0de807f"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/AlchemyCMS/alchemy_cms/pull/3982"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-57579",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-14T17:39:44.487415Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-14T17:39:56.953Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "alchemy_cms",
              "vendor": "AlchemyCMS",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 7.4.15"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 8.0.0, \u003c 8.0.15"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 8.1.0, \u003c 8.1.14"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 8.2.0, \u003c 8.2.6"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller\u0027s ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-14T16:54:19.932Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh"
            },
            {
              "name": "https://github.com/AlchemyCMS/alchemy_cms/pull/3982",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/AlchemyCMS/alchemy_cms/pull/3982"
            },
            {
              "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3"
            },
            {
              "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99"
            },
            {
              "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f"
            },
            {
              "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af853e83b4a3a",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af853e83b4a3a"
            },
            {
              "name": "https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db01987d0de807f",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db01987d0de807f"
            },
            {
              "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15"
            },
            {
              "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15"
            },
            {
              "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14"
            },
            {
              "name": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6"
            }
          ],
          "source": {
            "advisory": "GHSA-mqq5-j7w8-2hgh",
            "discovery": "UNKNOWN"
          },
          "title": "Alchemy: Unauthenticated nested page API leaks restricted \u0026 unpublished content"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-57579",
        "datePublished": "2026-09-14T16:54:19.932Z",
        "dateReserved": "2026-06-24T18:49:56.208Z",
        "dateUpdated": "2026-09-14T17:40:12.109Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-57579

Vulnerability from fkie_nvd - Published: 2026-09-14 17:17 - Updated: 2026-09-30 19:57

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3
	security-advisories@github.com	https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99
	security-advisories@github.com	https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f
	security-advisories@github.com	https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af853e83b4a3a
	security-advisories@github.com	https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db01987d0de807f
	security-advisories@github.com	https://github.com/AlchemyCMS/alchemy_cms/pull/3982
	security-advisories@github.com	https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15
	security-advisories@github.com	https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15
	security-advisories@github.com	https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14
	security-advisories@github.com	https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6
	security-advisories@github.com	https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "alchemy_cms",
          "vendor": "AlchemyCMS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.4.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.0.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.1.0, \u003c 8.1.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.0, \u003c 8.2.6"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller\u0027s ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6."
    }
  ],
  "id": "CVE-2026-57579",
  "lastModified": "2026-09-30T19:57:08.043",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-57579",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-14T17:39:44.487415Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-14T17:17:49.267",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af853e83b4a3a"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db01987d0de807f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/AlchemyCMS/alchemy_cms/pull/3982"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-MQQ5-J7W8-2HGH

Vulnerability from github – Published: 2026-06-19 17:47 – Updated: 2026-06-19 17:47

Summary

AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished content

Details

Unauthenticated nested page API leaks restricted & unpublished content

Location: app/controllers/alchemy/api/pages_controller.rb:28 (Api::PagesController#nested)
Affected version: Alchemy CMS 8.3.0.dev (Rails 8.1.3)

Description

The unauthenticated GET /api/pages/nested endpoint returns the full page tree to any anonymous caller, including restricted (member-only) pages and unpublished/draft pages that should be hidden. Appending ?elements=true additionally dumps the element/ingredient content of restricted pages, fully bypassing the access control the sibling show and index actions enforce.

Root cause

Api::PagesController#nested calls no authorize! and applies no published/restricted scoping, unlike show (authorize! :show) and index (accessible_by(current_ability, :index)). PageTreePreloader loads page.self_and_descendants unfiltered, and PageTreeSerializer emits every page's metadata (and, with elements, public_version.elements) with no ability check.

Evidence

An unauthenticated GET /api/pages/nested returns HTTP 200 with the restricted page ("restricted":true) and an unpublished draft ("public":false); ?elements=true leaks its content (e.g. TOPSECRET_RESTRICTED_BODY_proof123). The same guest hitting GET /api/pages/3 (show) gets HTTP 403 {"error":"Not authorized"}, proving nested returns what show correctly denies.

Reproduction

# 1) Metadata leak (guest, no auth)
curl -s http://localhost:3000/api/pages/nested | python3 -m json.tool | grep -E '"name"|"restricted"|"public"'

# 2) Content leak of restricted page
curl -s "http://localhost:3000/api/pages/nested?elements=true" | grep -oE 'TOPSECRET_RESTRICTED_BODY_[A-Za-z0-9]+|RESTRICTED_RICHTEXT_[A-Za-z0-9]+'

# 3) Contrast — show denies the same guest
curl -s -o /dev/null -w "show /api/pages/3 -> HTTP %{http_code}\n" http://localhost:3000/api/pages/3

Suggested fix

def nested
  @page = Page.find_by(id: params[:page_id]) || Language.current_root_page
  authorize! :show, @page
  preloaded_page = PageTreePreloader.new(page: @page, user: current_alchemy_user, ability: current_ability).call
  render json: PageTreeSerializer.new(preloaded_page, ability: current_ability,
                                      user: current_alchemy_user, elements: params[:elements])
end

Additionally scope PageTreePreloader's self_and_descendants via accessible_by(current_ability) and gate element emission in PageTreeSerializer#page_elements behind opts[:ability].can?(:show, page).

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.2.5"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "alchemy_cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.2.0"
            },
            {
              "fixed": "8.2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.1.13"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "alchemy_cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.1.0"
            },
            {
              "fixed": "8.1.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.14"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "alchemy_cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0.a"
            },
            {
              "fixed": "8.0.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.4.14"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "alchemy_cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.4.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T17:47:13Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "# Unauthenticated nested page API leaks restricted \u0026 unpublished content\n\n- **Location:** `app/controllers/alchemy/api/pages_controller.rb:28` (`Api::PagesController#nested`)\n- **Affected version:** Alchemy CMS 8.3.0.dev (Rails 8.1.3)\n\n## Description\n\nThe unauthenticated `GET /api/pages/nested` endpoint returns the full page tree to any anonymous caller, including restricted (member-only) pages and unpublished/draft pages that should be hidden.\nAppending `?elements=true` additionally dumps the element/ingredient **content** of restricted pages, fully bypassing the access control the sibling `show` and `index` actions enforce.\n\n## Root cause\n\n`Api::PagesController#nested` calls no `authorize!` and applies no `published`/`restricted` scoping, unlike `show` (`authorize! :show`) and `index` (`accessible_by(current_ability, :index)`).\n`PageTreePreloader` loads `page.self_and_descendants` unfiltered, and `PageTreeSerializer` emits every page\u0027s metadata (and, with `elements`, `public_version.elements`) with no ability check.\n\n## Evidence\n\nAn unauthenticated `GET /api/pages/nested` returns HTTP 200 with the restricted page (`\"restricted\":true`) and an unpublished draft (`\"public\":false`); `?elements=true` leaks its content (e.g. `TOPSECRET_RESTRICTED_BODY_proof123`).\nThe same guest hitting `GET /api/pages/3` (`show`) gets HTTP **403** `{\"error\":\"Not authorized\"}`, proving `nested` returns what `show` correctly denies.\n\n### Reproduction\n\n```bash\n# 1) Metadata leak (guest, no auth)\ncurl -s http://localhost:3000/api/pages/nested | python3 -m json.tool | grep -E \u0027\"name\"|\"restricted\"|\"public\"\u0027\n\n# 2) Content leak of restricted page\ncurl -s \"http://localhost:3000/api/pages/nested?elements=true\" | grep -oE \u0027TOPSECRET_RESTRICTED_BODY_[A-Za-z0-9]+|RESTRICTED_RICHTEXT_[A-Za-z0-9]+\u0027\n\n# 3) Contrast \u2014 show denies the same guest\ncurl -s -o /dev/null -w \"show /api/pages/3 -\u003e HTTP %{http_code}\\n\" http://localhost:3000/api/pages/3\n```\n\n### Suggested fix\n\n```ruby\ndef nested\n  @page = Page.find_by(id: params[:page_id]) || Language.current_root_page\n  authorize! :show, @page\n  preloaded_page = PageTreePreloader.new(page: @page, user: current_alchemy_user, ability: current_ability).call\n  render json: PageTreeSerializer.new(preloaded_page, ability: current_ability,\n                                      user: current_alchemy_user, elements: params[:elements])\nend\n```\n\nAdditionally scope `PageTreePreloader`\u0027s `self_and_descendants` via `accessible_by(current_ability)` and gate element emission in `PageTreeSerializer#page_elements` behind `opts[:ability].can?(:show, page)`.",
  "id": "GHSA-mqq5-j7w8-2hgh",
  "modified": "2026-06-19T17:47:13Z",
  "published": "2026-06-19T17:47:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/AlchemyCMS/alchemy_cms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AlchemyCMS: Unauthenticated nested page API leaks restricted \u0026 unpublished content"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-57579 (GCVE-0-2026-57579)

FKIE_CVE-2026-57579

GHSA-MQQ5-J7W8-2HGH

Unauthenticated nested page API leaks restricted & unpublished content

Description

Root cause

Evidence

Reproduction

Suggested fix

Tags

Sightings

Nomenclature

Related by attack behaviour