Description

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-14T17:17:49.267Z",
  "pubdate": "2026-09-14T17:17:49.267Z",
  "executiveSummary": "The vulnerability is an Improper Authorization flaw identified in the Alchemy CMS open-source content management system. It allows unauthenticated remote attackers to access sensitive metadata, unpublished page hierarchies, and internal content elements via the API.\nThe security impact involves the unauthorized disclosure of potentially sensitive information, including internal site structure and protected page contents that are otherwise restricted by the application's native authorization logic. This exposure occurs because the affected endpoint fails to perform necessary access control checks on requested resources.\nThe affected product is the Alchemy CMS Ruby on Rails engine. Systems running versions prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6 are susceptible to this risk. No specific privileges or authentication tokens are required to exploit the flaw, as the vulnerable endpoint is accessible to any anonymous user capable of reaching the network path.\nExploitation is trivial, requiring only a standard HTTP GET request. The risk is significant as it bypasses the security controls applied to other API actions, such as the standard show action, thereby leaking data that the site administrator intended to keep private.",
  "technicalDetails": "The vulnerability resides within the Api::PagesController#nested function located in app/controllers/alchemy/api/pages_controller.rb. The root cause is the total absence of authorization logic and scoping within the nested endpoint, which is designed to return a hierarchical representation of the site's page tree.\nSpecifically, the Api::PagesController#nested action performs a database query to retrieve page tree structures without invoking the application's Ability model or equivalent authorization middleware. Consequently, the controller returns the entire tree structure to any unauthenticated caller, regardless of the visibility status or restriction level of individual pages.\nThe exploitation flow is straightforward: An attacker initiates an unauthenticated GET request to the /api/pages/nested endpoint. Because the controller does not filter the result set based on the caller's permissions, the application serializes the entire page tree and transmits it to the attacker.\nThe risk is further amplified when the 'elements=true' parameter is included in the request. In this scenario, the PageTreePreloader and PageTreeSerializer are triggered to include element and ingredient content associated with the pages. Because these auxiliary components also fail to perform an ability check, the attacker can extract detailed content from restricted or unpublished pages, effectively bypassing the visibility restrictions enforced on standard 'show' requests.\nThe technical vulnerability is compounded by the fact that the PageTreeSerializer blindly trusts the data retrieved from the database, ignoring the security posture of the individual records. Since the controller, preloader, and serializer all lack access control integration, the full content of the restricted pages is exposed via the API response. This behavior allows an attacker to map the internal site structure and exfiltrate content intended for private or administrative use, impacting the confidentiality of the content management system's data architecture."
}