Unfiltered Page Metadata Exposure in Alchemy CMS by Alchemy Solutions
CVE-2026-57579
7.5HIGH
What is CVE-2026-57579?
Alchemy CMS has a critical vulnerability that allows unauthenticated users to access sensitive page metadata via the unprotected /api/pages/nested endpoint. This flaw arises because the endpoint does not enforce necessary authorization checks, enabling attackers to retrieve details of unpublished or restricted pages. Furthermore, when the 'elements=true' parameter is included in requests, the PageTreeSerializer returns content from these restricted elements and ingredients without verifying the caller's permissions. The issue has been addressed in releases 7.4.15, 8.0.15, 8.1.14, and 8.2.6.
Affected Version(s)
alchemy_cms < 7.4.15 < 7.4.15
alchemy_cms >= 8.0.0, < 8.0.15 < 8.0.0, 8.0.15
alchemy_cms >= 8.1.0, < 8.1.14 < 8.1.0, 8.1.14