{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/alchemycms--7.4.16-8.x--8.3.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:alchemycms:alchemy_cms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.3,"id":"CVE-2026-86777"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AlchemyCMS (\u003c 7.4.16, 8.x \u003c 8.3.6)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["AlchemyCMS"],"content_html":"\u003cp\u003eCVE-2026-86777 is a missing authorization vulnerability (CWE-862) in AlchemyCMS. The issue resides in the /api/nodes endpoint, which fails to properly enforce authorization checks, allowing unauthenticated users to access navigation node information. This can result in the exposure of restricted or unpublished page metadata, site structures, and internal navigation URLs.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to perform reconnaissance by retrieving navigation structures, multilingual site hierarchies, and names or URLs of unpublished pages, which may provide sensitive context for further targeting.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade AlchemyCMS instances to version 7.4.16 or 8.3.6 immediately to resolve the missing authorization flaw.\u003c/li\u003e\n\u003cli\u003eImplement access controls or network-level restrictions on the /api/nodes endpoint if immediate patching is not possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T12:48:51Z","date_published":"2026-11-07T12:48:51Z","id":"https://feed.craftedsignal.io/briefs/2026-11-alchemycms-auth-bypass/","summary":"An authorization vulnerability in AlchemyCMS allows unauthenticated attackers to retrieve sensitive navigation node data through the /api/nodes endpoint, facilitating information gathering.","title":"AlchemyCMS: Navigation data disclosure via missing authorization (CVE-2026-86777)","url":"https://feed.craftedsignal.io/briefs/2026-11-alchemycms-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - AlchemyCMS (\u003c 7.4.16, 8.x \u003c 8.3.6)","version":"https://jsonfeed.org/version/1.1"}