Live › vulnerability › CVE-2026-119763
Changelog.com's preview routes in its post, newsletter and news controllers skip authorization checks before commit 7b35e829. An unauthenticated attacker can guess post IDs, newsletter slugs or news IDs and read draft posts, unsent newsletters and declined news items.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Only deployments of changelog.com built from commits before 7b35e829 are exposed, and only through the preview routes in the post, newsletter and news controllers. Teams running other code or a current build can skip it. unknown whether any hosted instance is unpatched.
No product ranges from the sources yet.
7b35e829.7b35e829 or later (source gives no release tag).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items.
This page as .md · .json · in your agent: get_signal("CVE-2026-119763")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.