Summary

Alchemy::Api::NodesController#index (GET /api/nodes) returns every menu node of every site and every language with no authorization check and no site/language scoping. It is the only API index action with neither accessible_by nor authorize!. Because a menu node attached to a page derives its name and url from that page (Node#name → page.name, Node#url → page.url_path), an anonymous request also discloses names and URL paths of pages that are restricted (members-only) or not published (draft), plus any internal URLs editors placed in menus.

This is the same class the maintainer fixed in the sibling action Api::PagesController#nested (advisory GHSA-mqq5-j7w8-2hgh) and in PR #2145 ("Do not leak all records for guest users in API controllers"). nodes#index was not covered.