CVE-2026-86777

Medium

Description

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.

SeverityMedium

CVSS5.3

Exploit probability—

ProductAlchemycms Alchemy Cms

PublishedSep 9, 2026

First seenSep 9, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

AlchemyCMS alchemy_cms7.4.16, 8.3.6 or later

Patches

github.com/AlchemyCMS/alchemy_cms/commit/5e2cd16a806c9d2df3eb6e3c889402487e0085b6
github.com/AlchemyCMS/alchemy_cms/commit/9bdb98496d6f17277ed05dd1abc3188f880aa554

Vendor advisories

github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-wppq-8h64-w78r
github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.6
github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.16

Affected products

Product	Affected versions	Fixed in
AlchemyCMS alchemy_cms	v < 7.4.16, 8.0.0 ≤ v < 8.3.6	7.4.16, 8.3.6

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.