Executive brief
AlchemyCMS, a content management system for Ruby on Rails, contains a security flaw where restricted and unpublished content can be accessed by unauthorized users. By accessing a specific internal API endpoint, an attacker can view the entire website structure and private page content that should be hidden from the public. This could lead to the exposure of sensitive member-only information or internal drafts before they are ready for publication.
Technical details
A missing authorization check (CWE-862) exists in the `Api::PagesController#nested` action of AlchemyCMS. Unlike the `show` and `index` actions, the `nested` endpoint fails to call `authorize!` or apply `published`/`restricted` scoping to the page tree. An unauthenticated attacker can perform a GET request to `/api/pages/nested` to retrieve metadata for all pages, including those marked as private or drafts. Furthermore, by appending the `?elements=true` parameter, the attacker can retrieve the full content of these restricted pages. Patches are available in versions 8.2.6, 8.1.14, 8.0.15, and 7.4.15.
Affected products
- AlchemyCMS alchemy_cms >= 8.2.0, <= 8.2.5; >= 8.1.0, <= 8.1.13; >= 8.0.0.a, <= 8.0.14; <= 7.4.14
Timeline
- 2026-06-18: disclosed
- 2026-06-19: advisory