CVE-2026-86777: AlchemyCMS unauthenticated API access

CVE-2026-86777 identifies a missing authorization check in AlchemyCMS, an open-source CMS for web content management. The GET /api/nodes API endpoint does not perform authentication verification, allowing anyone—even from outside the corporate network—to request and obtain the complete list of all navigation nodes for every site and language managed by an instance. This exposes page names, internal URL structures, and links that are normally restricted to web infrastructure administrators.

The vulnerability has a CVSS score of 5.3 (medium) and affects AlchemyCMS versions before 7.4.16 and all 8.x versions up to 8.3.6. NVD confirmed the flaw on September 9, 2026. The significant factor is that on November 7, 2026, a public proof of concept was detected on GitHub: this signal indicates the flaw is now practically exploitable and known to the security research community.

AlchemyCMS instance administrators must prioritize updating the software to version 7.4.16 or later (7.x branch) or to 8.3.6 or later (8.x branch). Those unable to update immediately should verify the accessibility of the /api/nodes endpoint from uncontrolled networks and consider blocking it with WAF, reverse proxy, or application firewall. It is also recommended to review access logs to identify whether the endpoint has been requested.