CVE-2026-86777 in AlchemyCMS
Summary
by MITRE • 09/09/2026
AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in AlchemyCMS versions prior to 7.4.16 and 8.x prior to 8.3.6 represents a critical failure in access control mechanisms within the content management system's API layer. Specifically, the GET /api/nodes endpoint lacks proper authentication checks or authorization logic, allowing any unauthenticated user to interact with it directly via standard HTTP requests. This flaw stems from an incomplete implementation of security controls where the application fails to verify whether the requesting entity possesses valid credentials or appropriate permissions before processing the request and returning sensitive data. In a properly secured environment, such administrative or internal API endpoints should require explicit authentication tokens or session validation to ensure that only authorized administrators or specific service accounts can access system metadata.
The technical consequence of this misconfiguration is the unrestricted disclosure of structured navigation node information for all sites configured within the AlchemyCMS instance and across all supported languages. The endpoint returns a comprehensive list containing page names, URL paths, and internal URLs that are typically intended to be hidden from public view or restricted to authenticated users only. By exploiting this flaw, an attacker can map out the entire site structure without needing any prior knowledge of valid user accounts or passwords. This level of information exposure provides a detailed blueprint of the application's architecture, revealing how content is organized and which pages exist within the system hierarchy.
From an operational impact perspective, while the immediate risk may appear limited to informational disclosure, this vulnerability significantly aids in subsequent attack phases such as reconnaissance and targeted exploitation. Knowledge of internal URLs and page structures allows attackers to identify potentially vulnerable endpoints, deprecated features, or administrative interfaces that might have their own distinct vulnerabilities. It also facilitates social engineering attacks by providing context about the organization's digital footprint. Furthermore, if any of these nodes correspond to pages with known weaknesses in input validation or business logic, the attacker can prioritize those targets for further exploitation. The exposure of internal URLs may also reveal backend routing patterns that could be leveraged in path traversal attempts or other directory-based attacks against underlying web server configurations.
This vulnerability aligns closely with CWE-284 Improper Access Control and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor, as it involves both a failure to restrict access and the subsequent leakage of sensitive data. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1592 Gather Victim Host Information, specifically through techniques that involve scraping or querying public-facing resources for structural details. To mitigate this issue, administrators must upgrade AlchemyCMS immediately to version 7.4.16 or later, including all versions in the 8.x branch up to and including 8.3.6 where these access control checks have been properly implemented. Until an upgrade is feasible, implementing a Web Application Firewall rule to block unauthenticated requests to the /api/nodes endpoint can serve as a temporary compensating control. Additionally, organizations should conduct a thorough review of their API endpoints to ensure that all internal or administrative interfaces enforce strict authentication and authorization protocols consistent with industry best practices for secure software development.