CyberSecBulletin

AlchemyCMS vulnerabilities

We track 2 vulnerabilities in AlchemyCMS products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 14, 2026.

2vulnerabilities
1critical
1high
0exploited
8.7average CVSS score

Latest AlchemyCMS vulnerabilities

  • 7.5 High severity

    alchemy_cms: Missing Authorization

    CVE-2026-57579AlchemyCMS

    Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_

  • 9.9 Critical severity

    alchemy_cms: Improper Neutralization of Directives in Dynamically Evaluated Code

    CVE-2026-23885AlchemyCMS

    Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()` function to dynamically execute a string provided by the `resource_handler.engine_name` attribute in