---
id: "CVE-2026-119763"
kind: "vulnerability"
aliases: ["CVE-2026-119763"]
title: "changelog.com: unauthenticated users can read unpublished drafts and newsletters"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["changelog.com", "elixir", "other", "phoenix", "self-hosted"]
not_affected_if: ["current-commit", "no-public-instance"]
published_at: "2026-10-30T18:17:27+00:00"
first_seen_at: "2026-10-30T18:55:29+00:00"
updated_at: "2026-10-30T18:56:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119763", "first_seen_at": "2026-10-30T18:55:29+00:00"}]
---

# changelog.com: unauthenticated users can read unpublished drafts and newsletters

Changelog.com's preview routes in its post, newsletter and news controllers skip authorization checks before commit 7b35e829. An unauthenticated attacker can guess post IDs, newsletter slugs or news IDs and read draft posts, unsent newsletters and declined news items.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployed changelog.com code is at or after commit `7b35e829`.
- Confirm whether preview routes in PostController, NewsIssueController and NewsItemController are reachable without login.

## Fix

- Move to commit `7b35e829` or later (source gives no release tag).

## Timeline

- 2026-10-30T18:55:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119763

## From the sources

changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_