CVE-2026-57579: 
Ruby vulnerability analysis and mitigation

CVE-2026-57579 is a Missing Authorization vulnerability in AlchemyCMS (the alchemy_cms RubyGems package) that allows unauthenticated attackers to access restricted and unpublished page content via the nested page API endpoint. The flaw was published on June 18, 2026 by maintainer tvdeyen and affects versions up to and including 7.4.14, 8.0.0.a–8.0.14, 8.1.0–8.1.13, and 8.2.0–8.2.5. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, GitHub Advisory DB).

The root cause is CWE-862 (Missing Authorization) in app/controllers/alchemy/api/pages_controller.rb at line 28, within the Api::PagesController#nested action. Unlike the sibling show action (which calls authorize! :show) and the index action (which uses accessible_by(current_ability, :index)), the nested action performs no authorization check and applies no published/restricted scoping. As a result, PageTreePreloader loads page.self_and_descendants unfiltered, and PageTreeSerializer emits every page's metadata — and, when ?elements=true is appended, the full element/ingredient content — without any ability check, fully bypassing access controls (GitHub Advisory).

Any unauthenticated, remote attacker can retrieve the complete page tree of an Alchemy CMS installation, including pages marked as restricted (member-only) and unpublished/draft pages that are intended to be hidden. By appending ?elements=true to the request, the attacker also obtains the full content of those restricted pages (e.g., body text, rich text ingredients), representing a significant confidentiality breach. There is no integrity or availability impact, but sensitive business or user data stored in draft or member-only pages is fully exposed (GitHub Advisory).

Exploitation requires no authentication, no special privileges, and no user interaction — a single unauthenticated HTTP GET request is sufficient. Proof-of-concept reproduction steps are publicly documented in the GitHub Security Advisory, including specific curl commands. No exploit kits, threat actor attribution, or CISA KEV catalog listing have been identified at this time. The EPSS score is not yet published (GitHub Advisory, GitHub Advisory DB).

1. Reconnaissance: Identify internet-facing AlchemyCMS installations (e.g., via Shodan, Censys, or web crawlers) running affected versions (≤7.4.14, 8.0.0.a–8.0.14, 8.1.0–8.1.13, or 8.2.0–8.2.5).
2. Metadata leak: Send an unauthenticated GET request to the nested page API endpoint to retrieve the full page tree, including restricted and unpublished pages:

   curl -s http://<target>/api/pages/nested | python3 -m json.tool | grep -E '"name"|"restricted"|"public"'

3. Content leak: Append ?elements=true to dump the element and ingredient content of all pages, including restricted ones:

   curl -s "http://<target>/api/pages/nested?elements=true"

4. Confirm bypass: Verify that the show endpoint correctly denies access to the same restricted page (HTTP 403), confirming the nested endpoint is the unprotected vector:

   curl -s -o /dev/null -w "show /api/pages/3 -> HTTP %{http_code}\n" http://<target>/api/pages/3

5. Exfiltrate data: Parse the JSON response to extract sensitive content from restricted or draft pages for further use (GitHub Advisory).

• Network: Unauthenticated HTTP GET requests to /api/pages/nested or /api/pages/nested?elements=true from external or unexpected IP addresses.
• Logs: Web server or Rails application logs showing GET /api/pages/nested returning HTTP 200 to unauthenticated (no session/cookie) clients, especially with the elements=true parameter.
• Logs: Anomalous access patterns where the same client IP receives HTTP 403 on /api/pages/<id> (show) but HTTP 200 on /api/pages/nested, indicating deliberate bypass attempts (GitHub Advisory).

AlchemyCMS has released patched versions addressing this vulnerability: 7.4.15, 8.0.15, 8.1.14, and 8.2.6. Administrators should upgrade to the appropriate patched version immediately. As a temporary workaround (if upgrading is not immediately possible), network-level controls (e.g., WAF rules or reverse proxy configuration) can be used to block unauthenticated access to the /api/pages/nested endpoint. The suggested code fix involves adding authorize! :show, @page to the nested action, scoping PageTreePreloader's self_and_descendants via accessible_by(current_ability), and gating element emission in PageTreeSerializer#page_elements behind an ability check (GitHub Advisory).