CVE-2026-86777— AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes
Quick assessment
Affected
AlchemyCMS alchemy_cms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 7.4.16 之前的 AlchemyCMS 以及 8.x 中 8.3.6 之前的版本中，GET /api/nodes 端点未对访问进行身份验证，这使得未认证的攻击者能够获取所有导航节点。攻击者可以在无需身份验证的情况下访问该端点，从而从所有站点和语言中披露受限页面的名称、URL 路径以及内部 URL。
Possible ATT&CK Techniques 2 AI
T1041 · Exfiltration Over C2 Channel T1213 · Data from Information Repositories
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86777
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes
Source: CVE Program / CVE List V5
Vulnerability Description
AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AlchemyCMS | alchemy_cms | 0 ~ 7.4.16 | - |
|
II. Public POCs for CVE-2026-86777
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86777
请登录查看更多情报信息。
Other References for CVE-2026-86777 (8)
-
-
-
-
🔗 Release v8.3.6 · AlchemyCMS/alchemy_cms · GitHub release-notes
-
🔗 Release v7.4.16 · AlchemyCMS/alchemy_cms · GitHub release-notes
-
-
-
IV. Related Vulnerabilities
Same weakness: CWE-862
-
CVE-2026-41871
Apache Nutch: Unauthenticated reflection-based job execution -
CVE-2026-41869
Apache Nutch: Unauthenticated forced shutdown and job interr -
CVE-2026-41870
Apache Nutch: Unauthenticated remote code execution (RCE) vi -
CVE-2026-15398
Eventin – Event Calendar, Event Registration, Tickets & Book -
CVE-2026-19802
Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Mi
V. Comments for CVE-2026-86777
No comments yet