CVE-2026-57579
highAlchemy is an open source content management system engine written in Ruby on Rails.
Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3 security-advisories@github.com
- https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99 security-advisories@github.com
- https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f security-advisories@github.com
- https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af853e83b4a3a security-advisories@github.com
- https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db01987d0de807f security-advisories@github.com
- https://github.com/AlchemyCMS/alchemy_cms/pull/3982 security-advisories@github.com
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15 security-advisories@github.com
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15 security-advisories@github.com
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14 security-advisories@github.com
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6 security-advisories@github.com
- https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh security-advisories@github.com
- https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh 134c704f-9b21-4f2e-91b3-4a467353bcc0