Access Control Flaw in AlchemyCMS Affects Multiple Versions
CVE-2026-86777

6.9MEDIUM

Key Information:

Vendor

Alchemycms

Status
Alchemy Cms
Vendor
CVE Published:
9 September 2026

What is CVE-2026-86777?

AlchemyCMS versions prior to 7.4.16 and 8.x versions before 8.3.6 exhibit a flaw in access control mechanisms. The GET /api/nodes endpoint is accessible without authentication, enabling attackers to retrieve sensitive information, including navigation nodes, restricted page names, URL paths, and internal URLs across all sites and languages. This vulnerability highlights the importance of proper authorization checks to safeguard against potential data exposure.

Affected Version(s)

alchemy_cms 0 < 7.4.16

alchemy_cms 8.0.0 < 8.3.6

References

https://github.com/AlchemyCMS/alchemy_cms/security/adviso...
vendor-advisory
https://github.com/AlchemyCMS/alchemy_cms/commit/5e2cd16a...
patch
https://github.com/AlchemyCMS/alchemy_cms/commit/9bdb9849...
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shohruh Yo'ldoshov
.