CVE-2026-57579

Alchemy CMS, an open source Ruby on Rails content management engine, fails to enforce authorization on the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested. Because the endpoint performs no ability check and does not scope the returned page tree to the caller's permissions, anonymous attackers can retrieve metadata for restricted and unpublished pages that the sibling show action would deny. Supplying elements=true goes further: PageTreeSerializer, backed by PageTreePreloader, also returns element and ingredient content from restricted pages, since no ability check is applied to those records either. This is a high-severity (CVSS 7.5) information disclosure affecting sites running affected versions with the API exposed; no public proof of concept or known in-the-wild exploitation has been reported. The flaw is a missing-authorization issue (CWE-862) with network attack vector, no privileges or user interaction required, and high confidentiality impact but no integrity or availability impact.

What to do: Upgrade to the patched releases: 7.4.15, 8.0.15, 8.1.14, or 8.2.6 on the corresponding branch. If patching is delayed, disable the Alchemy API or block unauthenticated requests to /api/pages/nested at the reverse proxy or WAF. Review access logs for unauthenticated calls to /api/pages/nested (especially with elements=true) to determine whether restricted or unpublished page content was exposed, and treat any leaked draft/restricted content accordingly.