Executive brief
Alchemy CMS is a Ruby on Rails-based content management system. An unauthenticated attacker can access the /api/pages/nested endpoint to retrieve restricted and unpublished page content, bypassing access controls that normally protect sensitive page metadata and elements. This allows anonymous users to discover and read page content they should not have access to.
Technical details
The vulnerability is an authorization bypass in the Api::PagesController#nested action (app/controllers/alchemy/api/pages_controller.rb). The endpoint accepts unauthenticated GET requests to /api/pages/nested and returns an unfiltered page tree without checking user permissions or scoping results by caller ability. When the elements parameter is set to true, the PageTreeSerializer further leaks element and ingredient content from restricted pages without applying ability checks. The fix adds authorization checks (authorize! :show, @page) and passes the current ability to PageTreePreloader and the serializer to scope returned data by what the caller is permitted to read. Patches are available in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.
Affected products
- AlchemyCMS Alchemy CMS before 7.4.15, 8.0.15, 8.1.14, and 8.2.6
Timeline
- 2026-09-14: disclosed