Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-57579: Alchemy CMS API reveals restricted pages to anyone
CVE-2026-57579 · published 1 month ago
Summary
The public API of Alchemy CMS can be called without logging in and returns the full page structure, including pages that should be hidden or not yet published. This means outsiders could see content that was meant to stay private. Update Alchemy CMS to the latest release (7.4.15, 8.0.15, 8.1.14, or 8.2.6) to stop the data leak.
What to do
- Update thomas von deyen alchemy_cms to version 8.2.6.
- Update thomas von deyen alchemy_cms to version 8.1.14.
- Update thomas von deyen alchemy_cms to version 8.0.15.
- Update thomas von deyen alchemy_cms to version 7.4.15.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rubygems | thomas von deyen | alchemy_cms |
>= 8.2.0, <= 8.2.5 >= 8.1.0, <= 8.1.13 >= 8.0.0.a, <= 8.0.14 <= 7.4.14 Fix: upgrade to 8.2.6
|
Original advisory text
Alchemy: Unauthenticated nested page API leaks restricted & unpublished content
Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.
References
- https://github.com/advisories/GHSA-mqq5-j7w8-2hgh
- https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hg... Vendor Advisory
- https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd8... Patch
- https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d0... Patch
- https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09... Patch
- https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af85... Patch
- https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db0198... Patch
- https://github.com/AlchemyCMS/alchemy_cms/pull/3982 Patch
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15 URL
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15 URL
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14 URL
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57579... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-57579 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-862Missing Authorization
Timeline
Published14 Sep 2026
Updated15 Sep 2026
First seen19 Jun 2026
Track software like this
Free during beta