Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-57579— Alchemy: Unauthenticated nested page API leaks restricted & unpublished content

Quick assessment

Affected
AlchemyCMS alchemy_cms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Alchemy 是一个用 Ruby on Rails 编写的开源内容管理系统引擎。在 7.4.15、8.0.15、8.1.14 和 8.2.6 之前，由 中 实现的未授权 端点会返回未经过滤的页面树，因为它没有执行任何授权检查，也未根据调用者的权限范围限定后代节点。匿名调用者可以检索到受限或未发布页面的元数据，而这些元数据会被同级的 操作拒绝访问。当提供 参数时， 还会从受限页面中返回元素（element）和成分（ingredient）内容，因为 和序列化器未对这些记录应用权限检查。该问题已在版本 7.4.15、8

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts

Affected Version Matrix 4

VendorProduct Version RangeStatus
AlchemyCMS alchemy_cms < 7.4.15 affected
>= 8.0.0, < 8.0.15 affected
>= 8.1.0, < 8.1.14 affected
>= 8.2.0, < 8.2.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57579

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Alchemy: Unauthenticated nested page API leaks restricted & unpublished content
Source: CVE Program / CVE List V5
Vulnerability Description
Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
AlchemyCMS alchemy_cms < 7.4.15 -

II. Public POCs for CVE-2026-57579

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57579

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-57579 (6)

Vendor Advisories for CVE-2026-57579 (1)

Vendor Pages for CVE-2026-57579 (4)

IV. Related Vulnerabilities

Same product: alchemy_cms
Same vendor: AlchemyCMS
Same weakness: CWE-862

V. Comments for CVE-2026-57579

No comments yet

Leave a comment