CVE-2026-57579

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57579
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57579.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57579
Aliases
Published
2026-09-14T16:54:19Z
Modified
2026-09-16T03:47:08Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Alchemy: Unauthenticated nested page API leaks restricted & unpublished content
Details

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57579.json"
}
References

Affected packages

Git / github.com/alchemycms/alchemy_cms

Affected ranges

Type
GIT
Repo
https://github.com/alchemycms/alchemy_cms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
4f15fc7f7efda5ee1c6ff83602d3ea1ed615bec8
Introduced
114702f2d17863aff19124092b88ba973b5add83
Introduced
648b06b0fc15fba2bd32c67477dc3b70d9fc0264
Fixed
cf23fc93493399027d92837b1d2ba78fbbe8896a
Fixed
28b0df7a0763f6fc32decf83062f8649613c5a01
Fixed
d24adfa7c888a90e2015e17cce0b6519c205397b
Fixed
c7f40047974377e0b758a719be8dec39da2e5e36
Fixed
30888fb41d8b71fdfb3b116a7efccd851d73e1f3
Fixed
5620e76f0d274d6f69f34281b7e46d01879f6b99
Fixed
8417a2e9dcb00653c8b238f8a040b09532dd4c0f
Fixed
85702d9fe4e247649b1358900c5af853e83b4a3a
Fixed
a082dd0afe188d199f386a5e1db01987d0de807f
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.4.15"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.15"
        },
        {
            "introduced": "8.1.0"
        },
        {
            "fixed": "8.1.14"
        },
        {
            "introduced": "8.2.0"
        },
        {
            "fixed": "8.2.6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v.*
v.1.5.2
v1.*
v1.1.1
v1.2.0
v1.5.0
v1.5.1
v2.*
v2.0
v2.0.3
v2.0.3.1
v2.0.4
v2.0.5
v2.0.6
v2.0.6.1
v2.0.pre5
v2.0.rc1
v2.0.rc2
v2.0.rc3
v2.1.1
v2.1.2
v2.1.7b
v2.2.0
v2.2.rc1
v2.2.rc11
v2.2.rc13
v2.2.rc14
v2.2.rc15
v2.2.rc2
v2.2.rc3
v2.2.rc6
v2.2.rc7
v2.2.rc8
v2.3.rc5
v2.4.beta2
v2.4.rc1
v2.4.rc2
v2.4.rc4
v2.5.0.b2
v2.5.0.b5
v2.5.0.b9
v2.5.0.rc3
v2.5.0.rc4
v2.6.0.rc5
v3.*
v3.0.0
v3.0.0.rc5
v3.0.0.rc6
v3.0.0.rc7
v3.0.0.rc8
v3.1.0.beta1
v3.1.0.beta2
v3.1.0.beta3
v3.1.0.beta4
v3.1.0.beta5
v3.1.0.beta6
v3.1.0.rc1
v3.2.0.beta
v3.3.0.rc1
v3.3.0.rc2
v3.6.0
v4.*
v4.0.0.beta
v4.0.0.rc1
v4.0.0.rc2
v4.1.0.beta
v4.1.0.rc1
v4.2.0
v4.3.0
v4.4.2
v4.4.3
v5.*
v5.0.0.beta1
v5.0.0.beta2
v5.1.0.beta1
v5.1.0.beta2
v5.1.0.rc1
v5.2.0.b1
v6.*
v6.0.0
v6.0.0.b1
v6.0.0.b2
v6.0.0.b3
v6.0.0.pre.b4
v6.0.0.pre.b5
v6.0.0.pre.b6
v6.0.0.pre.rc1
v6.0.0.pre.rc2
v6.0.0.pre.rc3
v6.0.0.pre.rc4
v6.0.0.pre.rc5
v6.0.0.pre.rc6
v6.0.0.pre.rc7
v7.*
v7.0.0
v7.0.0.pre.a
v7.0.0.pre.b
v7.0.0.pre.c
v7.0.0.pre.rc1
v7.1.0
v7.1.0.pre.b1
v7.1.0.pre.b2
v7.1.0.pre.rc1
v7.2.0
v7.2.0.b
v7.2.0.rc1
v7.2.0.rc2
v7.2.1
v7.3.0
v7.3.1
v7.3.2
v7.3.3
v7.3.4
v7.4.0
v7.4.1
v7.4.10
v7.4.11
v7.4.12
v7.4.13
v7.4.14
v7.4.2
v7.4.3
v7.4.4
v7.4.5
v7.4.6
v7.4.7
v7.4.8
v7.4.9
v8.*
v8.0.0
v8.0.0.a
v8.0.0.b
v8.0.1
v8.0.10
v8.0.11
v8.0.12
v8.0.13
v8.0.14
v8.0.2
v8.0.3
v8.0.4
v8.0.5
v8.0.6
v8.0.7
v8.0.8
v8.0.9
v8.1.0
v8.1.1
v8.1.10
v8.1.11
v8.1.12
v8.1.13
v8.1.2
v8.1.3
v8.1.4
v8.1.5
v8.1.6
v8.1.7
v8.1.8
v8.1.9
v8.2.0
v8.2.1
v8.2.2
v8.2.3
v8.2.4
v8.2.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57579.json"