CVE-2026-119763— changelog.com before commit 7b35e829 Missing Authorization via Preview Routes

Quick assessment

Affected

thechangelog changelog.com

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在提交之前的版本存在一个缺少授权验证的漏洞。该漏洞允许未认证的攻击者通过、和中的预览路由（preview routes）读取未发布的内容。攻击者可以利用哈希 ID（hashid）形式的帖子 ID、顺序排列的通讯（newsletter）别名（slugs）以及整数形式的新闻 ID，针对预览端点进行枚举，从而读取草稿帖子、未发送的通讯以及被驳回的新闻条目。

CVSS 5.3 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
thechangelog	changelog.com	`< 7b35e82934be93e8b0064299a611c98d55b3e0eb`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

changelog.com before commit 7b35e829 Missing Authorization via Preview Routes

Source: CVE Program / CVE List V5

Vulnerability Description

changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
thechangelog	changelog.com	0 ~ 7b35e82934be93e8b0064299a611c98d55b3e0eb	-

II. Public POCs for CVE-2026-119763

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119763

请登录查看更多情报信息。

Other References for CVE-2026-119763 (6)

https://hackmd.io/@hieund/changelog-com-preview-unpublished-content-missing-authz third-party-advisory
https://github.com/thechangelog/changelog.com/commit/7b35e82934be93e8b0064299a611c98d55b3e0eb patch
https://github.com/thechangelog/changelog.com/blob/73fdd9e19cb609573f9cd8ed195cd9abaeb24f8a/lib/changelog_web/controllers/post_controller.ex#L48-L49 technical-description
https://github.com/thechangelog/changelog.com/issues/581 issue-tracking
https://github.com/thechangelog/changelog.com product
https://www.vulncheck.com/advisories/changelog-com-before-commit-7b35e829-missing-authorization-via-preview-routes third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119763

IV. Related Vulnerabilities

Same weakness: CWE-862