# CVE-2026-57579: Alchemy CMS authorization bypass in pages API endpoint

Source: https://junglewise.ai/threats/cve-2026-57579-alchemy-cms-authorization-bypass-in-pages-api-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-57579 · Severity: high · CVSS 7.5 · Published 2026-09-14

Alchemy CMS is a Ruby on Rails-based content management system. An unauthenticated attacker can access the /api/pages/nested endpoint to retrieve restricted and unpublished page content, bypassing access controls that normally protect sensitive page metadata and elements. This allows anonymous users to discover and read page content they should not have access to.

Technologies: [alchemy_cms (RubyGems)](https://junglewise.ai/threats/technologies/alchemy-cms). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-57579 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57579 being exploited in the wild.

**How severe is CVE-2026-57579?** High severity, with a CVSS score of 7.5, published 14 September 2026.

**Which products and versions are affected?** alchemy_cms (RubyGems) ECOSYSTEM:introduced=8.2.0,fixed=8.2.6.

**Is there a fix for CVE-2026-57579?** Yes. alchemy_cms (RubyGems): upgrade to 8.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57579 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-57579?** Check whether you run alchemy_cms (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- alchemy_cms (RubyGems): upgrade to 8.2.6 or later

  ```sh
  bundle update alchemy_cms
  ```


## Technical details

The vulnerability is an authorization bypass in the Api::PagesController#nested action (app/controllers/alchemy/api/pages_controller.rb). The endpoint accepts unauthenticated GET requests to /api/pages/nested and returns an unfiltered page tree without checking user permissions or scoping results by caller ability. When the elements parameter is set to true, the PageTreeSerializer further leaks element and ingredient content from restricted pages without applying ability checks. The fix adds authorization checks (authorize! :show, @page) and passes the current ability to PageTreePreloader and the serializer to scope returned data by what the caller is permitted to read. Patches are available in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.

## Affected products

- AlchemyCMS Alchemy CMS before 7.4.15, 8.0.15, 8.1.14, and 8.2.6

## Identifiers

- CVE-2026-57579
- GHSA-mqq5-j7w8-2hgh

## Timeline

- 2026-09-14: disclosed

## References

- [https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3](https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3)
- [https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99](https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99)

## Related threats

- [AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper](https://junglewise.ai/threats/cve-2026-23885-alchemycms-authenticated-remote-code-execution-rce-via-eval)
- [Withdrawn Advisory: AlchemyCMS is vulnerable to stored XSS via the /admin/pictures image field](https://junglewise.ai/threats/cve-2018-18307-withdrawn-advisory-alchemycms-is-vulnerable-to-stored-xss-via-the)