{"id":"GHSA-mqq5-j7w8-2hgh","title":"AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished content","summary":"AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished content","severity":"high","cvss":7.5,"cwe":["CWE-862"],"vendor":"alchemy_cms","product":"alchemy_cms","affected":["alchemy_cms >= 8.2.0, <= 8.2.5","alchemy_cms >= 8.1.0, <= 8.1.13","alchemy_cms >= 8.0.0.a, <= 8.0.14","alchemy_cms <= 7.4.14"],"patched":["alchemy_cms 8.2.6","alchemy_cms 8.1.14","alchemy_cms 8.0.15","alchemy_cms 7.4.15"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-mqq5-j7w8-2hgh","references":[{"url":"https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh"},{"url":"https://github.com/advisories/GHSA-mqq5-j7w8-2hgh"}],"tags":["ghsa","rubygems"],"ingestedAt":"2026-06-22T15:52:21.082Z","ecosystem":"rubygems","slug":"GHSA-mqq5-j7w8-2hgh","body":"## Overview\n\n# Unauthenticated nested page API leaks restricted & unpublished content\n\n- **Location:** `app/controllers/alchemy/api/pages_controller.rb:28` (`Api::PagesController#nested`)\n- **Affected version:** Alchemy CMS 8.3.0.dev (Rails 8.1.3)\n\n## Description\n\nThe unauthenticated `GET /api/pages/nested` endpoint returns the full page tree to any anonymous caller, including restricted (member-only) pages and unpublished/draft pages that should be hidden.\nAppending `?elements=true` additionally dumps the element/ingredient **content** of restricted pages, fully bypassing the access control the sibling `show` and `index` actions enforce.\n\n## Root cause\n\n`Api::PagesController#nested` calls no `authorize!` and applies no `published`/`restricted` scoping, unlike `show` (`authorize! :show`) and `index` (`accessible_by(current_ability, :index)`).\n`PageTreePreloader` loads `page.self_and_descendants` unfiltered, and `PageTreeSerializer` emits every page's metadata (and, with `elements`, `public_version.elements`) with no ability check.\n\n## Evidence\n\nAn unauthenticated `GET /api/pages/nested` returns HTTP 200 with the restricted page (`\"restricted\":true`) and an unpublished draft (`\"public\":false`); `?elements=true` leaks its content (e.g. `TOPSECRET_RESTRICTED_BODY_proof123`).\nThe same guest hitting `GET /api/pages/3` (`show`) gets HTTP **403** `{\"error\":\"Not authorized\"}`, proving `nested` returns what `show` correctly denies.\n\n### Reproduction\n\n```bash\n# 1) Metadata leak (guest, no auth)\ncurl -s http://localhost:3000/api/pages/nested | python3 -m json.tool | grep -E '\"name\"|\"restricted\"|\"public\"'\n\n# 2) Content leak of restricted page\ncurl -s \"http://localhost:3000/api/pages/nested?elements=true\" | grep -oE 'TOPSECRET_RESTRICTED_BODY_[A-Za-z0-9]+|RESTRICTED_RICHTEXT_[A-Za-z0-9]+'\n\n# 3) Contrast — show denies the same guest\ncurl -s -o /dev/null -w \"show /api/pages/3 -> HTTP %{http_code}\\n\" http://localhost:3000/api/pages/3\n```\n\n### Suggested fix\n\n```ruby\ndef nested\n  @page = Page.find_by(id: params[:page_id]) || Language.current_root_page\n  authorize! :show, @page\n  preloaded_page = PageTreePreloader.new(page: @page, user: current_alchemy_user, ability: current_ability).call\n  render json: PageTreeSerializer.new(preloaded_page, ability: current_ability,\n                                      user: current_alchemy_user, elements: params[:elements])\nend\n```\n\nAdditionally scope `PageTreePreloader`'s `self_and_descendants` via `accessible_by(current_ability)` and gate element emission in `PageTreeSerializer#page_elements` behind `opts[:ability].can?(:show, page)`.\n\n## Affected packages\n\n- `alchemy_cms >= 8.2.0, <= 8.2.5`\n- `alchemy_cms >= 8.1.0, <= 8.1.13`\n- `alchemy_cms >= 8.0.0.a, <= 8.0.14`\n- `alchemy_cms <= 7.4.14`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `alchemy_cms 8.2.6`\n- `alchemy_cms 8.1.14`\n- `alchemy_cms 8.0.15`\n- `alchemy_cms 7.4.15`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}