جزئیات آسیب‌پذیری

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.

• https://github.com/AlchemyCMS/alchemy_cms/pull/3982 x_refsource_MISC
• https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3 x_refsource_MISC
• https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99 x_refsource_MISC
• https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f x_refsource_MISC
• https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af853e83b4a3a x_refsource_MISC
• https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db01987d0de807f x_refsource_MISC
• https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15 x_refsource_MISC
• https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15 x_refsource_MISC
• https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14 x_refsource_MISC
• https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6 x_refsource_MISC
• https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh x_refsource_CONFIRM