{"id":"CVE-2026-119763","kind":"vulnerability","aliases":["CVE-2026-119763"],"related":[],"title":"changelog.com: unauthenticated users can read unpublished drafts and newsletters","description":"changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items.","summary":"Changelog.com's preview routes in its post, newsletter and news controllers skip authorization checks before commit 7b35e829. An unauthenticated attacker can guess post IDs, newsletter slugs or news IDs and read draft posts, unsent newsletters and declined news items.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["changelog.com","elixir","other","phoenix","self-hosted"],"not_affected_if":["current-commit","no-public-instance"],"how_to_check":"- Check whether the deployed changelog.com code is at or after commit `7b35e829`.\n- Confirm whether preview routes in PostController, NewsIssueController and NewsItemController are reachable without login.","fix":"- Move to commit `7b35e829` or later (source gives no release tag).","status":"open","published_at":"2026-10-30T18:17:27+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","triaged_at":"2026-10-30T18:56:56+00:00","updated_at":"2026-10-30T18:56:56+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-30T18:56:56Z","model":"claude-haiku-5-5","output":{"fix":"- Move to commit `7b35e829` or later (source gives no release tag).","reach":"internet","title":"changelog.com: unauthenticated users can read unpublished drafts and newsletters","impact":"low","summary":"Changelog.com's preview routes in its post, newsletter and news controllers skip authorization checks before commit 7b35e829. An unauthenticated attacker can guess post IDs, newsletter slugs or news IDs and read draft posts, unsent newsletters and declined news items.","audience":"businesses","category":"other","nicknames":[],"who_cares":["changelog.com","self-hosted","elixir","phoenix"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Unpublished drafts and unsent newsletters readable by anyone","analyst_note":"","how_to_check":"- Check whether the deployed changelog.com code is at or after commit `7b35e829`.\n- Confirm whether preview routes in PostController, NewsIssueController and NewsItemController are reachable without login.","plain_action":"","needs_analyst":false,"not_affected_if":["current-commit","no-public-instance"],"who_is_affected":"Only deployments of changelog.com built from commits before `7b35e829` are exposed, and only through the preview routes in the post, newsletter and news controllers. Teams running other code or a current build can skip it. unknown whether any hosted instance is unpatched.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00068,"input_tokens":4159,"output_tokens":528,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119763':12A,15A '-2026':11A,14A '7b35e829':39B,65C 'allow':72C 'attack':42B,74C,87C 'author':35B,69C 'changelog.com':1A,16B,23B,62C 'check':36B 'commit':38B,64C 'contain':66C 'content':78C 'control':33B 'cve':10A,13A 'declin':59B,110C 'draft':7A,54B,105C 'elixir':17B 'endpoint':102C 'enumer':89C 'guess':44B 'hashid':90C 'host':22B 'id':46B,51B,92C,99C 'integ':97C 'item':61B,112C 'miss':68C 'news':32B,50B,60B,98C,111C 'newsissuecontrol':84C 'newsitemcontrol':86C 'newslett':9A,30B,47B,57B,94C,108C 'phoenix':19B 'post':29B,45B,55B,91C,106C 'postcontrol':83C 'preview':25B,80C,101C 'read':5A,53B,76C,104C 'rout':26B,81C 'self':21B 'self-host':20B 'sequenti':93C 'skip':34B 'slug':48B,95C 'unauthent':2A,41B,73C 'unpublish':6A,77C 'unsent':56B,107C 'user':3A 'via':79C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Only deployments of changelog.com built from commits before `7b35e829` are exposed, and only through the preview routes in the post, newsletter and news controllers. Teams running other code or a current build can skip it. unknown whether any hosted instance is unpatched.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119763","severity":null,"published_at":"2026-10-30T18:17:27+00:00","modified_at":"2026-10-30T18:17:27+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","fetched_at":"2026-10-30T18:55:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}