CVE-2026-86777 AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes
Unauthenticated attackers can access the GET /api/nodes endpoint to disclose restricted page names, URL paths, and internal URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86777?
CVE-2026-86777 is a medium-severity missing authorization vulnerability in AlchemyCMS alchemy_cms, published on 9 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.
Weakness: CWE-862
Which versions are affected by CVE-2026-86777?
How do I fix CVE-2026-86777?
No fix has been published for CVE-2026-86777 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-86777 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-86777 exists.
Sources
Also known as GHSA-wppq-8h64-w78r, GHSA-wqff-85p9-hwc3.