Skip to content
Threat Feed
Subscribe
medium advisory

AlchemyCMS: Navigation data disclosure via missing authorization (CVE-2026-86777)

An authorization vulnerability in AlchemyCMS allows unauthenticated attackers to retrieve sensitive navigation node data through the /api/nodes endpoint, facilitating information gathering.

CVE search metadata

CVE search record: CVE-2026-86777. Severity: medium. CVSS: 5.3. EPSS: 0.56%. KEV: no. Product: AlchemyCMS (< 7.4.16, 8.x < 8.3.6). Brief: AlchemyCMS: Navigation data disclosure via missing authorization (CVE-2026-86777). Brief link: https://feed.craftedsignal.io/briefs/2026-11-alchemycms-auth-bypass/

Triage facts

Revision 1
Applicability
AlchemyCMS (< 7.4.16, 8.x < 8.3.6)
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Nov 7, 12:48 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

CVE-2026-86777 is a missing authorization vulnerability (CWE-862) in AlchemyCMS. The issue resides in the /api/nodes endpoint, which fails to properly enforce authorization checks, allowing unauthenticated users to access navigation node information. This can result in the exposure of restricted or unpublished page metadata, site structures, and internal navigation URLs.

Impact

Successful exploitation allows unauthenticated attackers to perform reconnaissance by retrieving navigation structures, multilingual site hierarchies, and names or URLs of unpublished pages, which may provide sensitive context for further targeting.

Recommendation

  • Upgrade AlchemyCMS instances to version 7.4.16 or 8.3.6 immediately to resolve the missing authorization flaw.
  • Implement access controls or network-level restrictions on the /api/nodes endpoint if immediate patching is not possible.

Immediate actions

Patch AlchemyCMS to version 7.4.16 or 8.3.6

IT Operations 48h

Threat Hunt

Identify excessive 200 OK responses to /api/nodes from unknown or external IP addresses

T1592 medium medium confidence hunt now

Data: Web server access logs

Mitigations

Apply access controls to /api/nodes to require authentication

immediate IT Operations

CVE-2026-86777

Detection coverage 1

Detect CVE-2026-86777 Exploitation - Unauthenticated Access to /api/nodes

medium

Detects unauthorized HTTP GET requests to the /api/nodes endpoint which may indicate exploitation of CVE-2026-86777.

sigma tactics: reconnaissance techniques: T1592 sources: webserver

Detection queries are available on the platform. Get full rules →