---
id: CVE-2026-119763
title: changelog.com before commit 7b35e829 Missing Authorization via Preview Routes
summary: >-
  changelog.com before commit 7b35e829 contains a missing authorization
  vulnerability that allows unauthenticated attackers to read unpublished
  content via preview routes in PostController, NewsIssueController and
  NewsItemController. Attac…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: thechangelog
product: changelog.com
affected:
  - changelog.com < 7b35e82934be93e8b0064299a611c98d55b3e0eb
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-30T19:14:12.861206Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T19:15:19.502Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119763'
references:
  - url: 'https://github.com/thechangelog/changelog.com/issues/581'
  - url: >-
      https://hackmd.io/@hieund/changelog-com-preview-unpublished-content-missing-authz
  - url: >-
      https://github.com/thechangelog/changelog.com/commit/7b35e82934be93e8b0064299a611c98d55b3e0eb
  - url: >-
      https://github.com/thechangelog/changelog.com/blob/73fdd9e19cb609573f9cd8ed195cd9abaeb24f8a/lib/changelog_web/controllers/post_controller.ex#L48-L49
  - url: 'https://github.com/thechangelog/changelog.com'
  - url: >-
      https://www.vulncheck.com/advisories/changelog-com-before-commit-7b35e829-missing-authorization-via-preview-routes
    label: >-
      VulnCheck Advisory: changelog.com before commit 7b35e829 Missing
      Authorization via Preview Routes
tags:
  - cve.org
  - exploit-available
epss: 0.00486
epssPercentile: 0.42112
ingestedAt: '2026-11-05T16:24:31.411Z'
---

## Overview

changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items.

## Affected

- `changelog.com < 7b35e82934be93e8b0064299a611c98d55b3e0eb`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.