AlchemyCMS (< 7.4.16, 8.x < 8.3.6) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/alchemycms--7.4.16-8.x--8.3.6/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 12:48:51 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAlchemyCMS: Navigation data disclosure via missing authorization (CVE-2026-86777)https://feed.craftedsignal.io/briefs/2026-11-alchemycms-auth-bypass/Sat, 07 Nov 2026 12:48:51 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-alchemycms-auth-bypass/An authorization vulnerability in AlchemyCMS allows unauthenticated attackers to retrieve sensitive navigation node data through the /api/nodes endpoint, facilitating information gathering.CVE-2026-86777 is a missing authorization vulnerability (CWE-862) in AlchemyCMS. The issue resides in the /api/nodes endpoint, which fails to properly enforce authorization checks, allowing unauthenticated users to access navigation node information. This can result in the exposure of restricted or unpublished page metadata, site structures, and internal navigation URLs.

Impact

Successful exploitation allows unauthenticated attackers to perform reconnaissance by retrieving navigation structures, multilingual site hierarchies, and names or URLs of unpublished pages, which may provide sensitive context for further targeting.

Recommendation

  • Upgrade AlchemyCMS instances to version 7.4.16 or 8.3.6 immediately to resolve the missing authorization flaw.
  • Implement access controls or network-level restrictions on the /api/nodes endpoint if immediate patching is not possible.
]]>mediumadvisory