Exposure of Sensitive Information Through Metadata Affecting alchemy_cms package, versions <7.4.16>=8.0.0.a, <8.3.6
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUBY-ALCHEMYCMS-18748190
- published13 Aug 2026
- disclosed7 Aug 2026
- creditshohruhyuldashev
Introduced: 7 Aug 2026
New CVE NOT AVAILABLE CWE-1230 (opens in a new tab)How to fix?
Upgrade alchemy_cms to version 7.4.16, 8.3.6 or higher.
Overview
Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata in the index action of Alchemy::Api::NodesController in app/controllers/alchemy/api/nodes_controller.rb. An attacker can disclose the navigation tree, including names and URL paths for restricted or unpublished pages and menu entries from other sites or languages, by sending an unauthenticated GET /api/nodes request. The endpoint returns Node.all without an access-control check, so anonymous callers receive node records that reference page names and URLs even when those pages are not meant to be visible. This exposes site structure and internal menu URLs to unauthenticated users and can reveal metadata about content that should remain hidden.