Missing Authorization Affecting alchemy_cms package, versions <7.4.15>=8.0.0.a, <8.0.15>=8.1.0, <8.1.14>=8.2.0, <8.2.6
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Missing Authorization vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-RUBY-ALCHEMYCMS-17660643
- published27 Jun 2026
- disclosed19 Jun 2026
- creditHaxset
Introduced: 19 Jun 2026
New CVE NOT AVAILABLE CWE-862 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade alchemy_cms to version 7.4.15, 8.0.15, 8.1.14, 8.2.6 or higher.
Overview
Affected versions of this package are vulnerable to Missing Authorization via the nested endpoint in the API controller. An attacker can access restricted and unpublished content by sending unauthenticated requests to the endpoint, which returns the full page tree including sensitive data without proper authorization checks. Appending the elements=true parameter further exposes the content of restricted pages.