---
id: CVE-2026-86777
title: >-
  AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize
  access to the GET /api/nodes endpoint, allowing unauthenticated attackers to
  retrieve all navigation nodes
summary: >-
  AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize
  access to the GET /api/nodes endpoint, allowing unauthenticated attackers to
  retrieve all navigation nodes. Attackers can access the endpoint without
  authentication…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-862
vendor: AlchemyCMS
product: alchemy_cms
affected:
  - alchemy_cms < 7.4.16
  - alchemy_cms >= 8.0.0 < 8.3.6
published: '2026-09-09'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T15:53:23.707'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86777'
references:
  - url: 'https://github.com/AlchemyCMS/alchemy_cms'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/AlchemyCMS/alchemy_cms/blob/v8.3.5/app/controllers/alchemy/api/nodes_controller.rb
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/AlchemyCMS/alchemy_cms/commit/5e2cd16a806c9d2df3eb6e3c889402487e0085b6
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/AlchemyCMS/alchemy_cms/commit/9bdb98496d6f17277ed05dd1abc3188f880aa554
    label: disclosure@vulncheck.com
  - url: 'https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.16'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.6'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-wppq-8h64-w78r
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/alchemycms-before-7.4.16-and-8-x-before-8.3.6-missing-authorization-on-get-api-nodes
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-wppq-8h64-w78r
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-09T14:04:08.114589Z'
ingestedAt: '2026-09-10T14:25:39.681Z'
epss: 0.0056
epssPercentile: 0.44188
---

## Overview

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.