SEPTEMBER 15, 2026
Live Feed
Back to database
Case File

CVE-2026-86777

MEDIUM · CVSS 5.3 EPSS 0.41% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-09 · Last synced 2026-09-15

CyberRota Analysis

AI-Generated

AlchemyCMS versions prior to 7.4.16 and 8.x before 8.3.6 are vulnerable due to improper authorization on the GET /api/nodes endpoint, enabling unauthenticated attackers to access sensitive navigation data. This exposure allows attackers to disclose restricted page names, URL paths, and internal URLs across all sites and languages. Organizations using these versions should prioritize remediation to protect their sensitive information from unauthorized access.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-86777
Severity
MEDIUM
CVSS
5.3
EPSS
0.41%

Original NVD Description

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal URLs from all sites and languages.