GHSA-mqq5-j7w8-2hgh: AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished content

June 19, 2026

The unauthenticated GET /api/pages/nested endpoint returns the full page tree to any anonymous caller, including restricted (member-only) pages and unpublished/draft pages that should be hidden. Appending ?elements=true additionally dumps the element/ingredient content of restricted pages, fully bypassing the access control the sibling show and index actions enforce.

References

github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh
github.com/advisories/GHSA-mqq5-j7w8-2hgh

Code Behaviors & Features

Detect and mitigate GHSA-mqq5-j7w8-2hgh with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →