PT-2026-88915

CVE-2026-86777

Published

2026-09-09

Updated

2026-09-09

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AlchemyCMS versions prior to 7.4.16 AlchemyCMS versions prior to 8.3.6

Description An authorization failure exists in the 'GET /api/nodes' endpoint, which allows unauthenticated attackers to retrieve all navigation nodes. This can lead to the disclosure of restricted page names, URL paths, and internal URLs across all sites and languages.

Recommendations Update to version 7.4.16 or later. Update to version 8.3.6 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Shohruh Yoldoshov

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers