Executive brief
AlchemyCMS is an open-source Rails content management system used to build websites. A flaw in versions before 7.4.16 and 8.x before 8.3.6 allows attackers to access the /api/nodes endpoint without authentication, exposing the internal structure of all sites—including hidden page names, URL paths, and internal links across multiple languages. This disclosure of site structure can facilitate further attacks and reveal sensitive organizational information.
Technical details
The vulnerability is an authentication bypass in the GET /api/nodes API endpoint that fails to enforce proper authorization checks. Attackers can send unauthenticated requests to retrieve navigation node data, which includes restricted page metadata such as page names, URL paths, and internal references from all configured sites and languages. The attack requires only network access to the vulnerable endpoint; no credentials or user interaction is needed. The vulnerability affects AlchemyCMS versions 7.x before 7.4.16 and all 8.x versions before 8.3.6. Patches are available in versions 7.4.16 and 8.3.6 or later.
Affected products
- AlchemyCMS Alchemy CMS 7.x before 7.4.16, 8.x before 8.3.6
Timeline
- 2026-09-09: disclosed