Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-119763medium6.9

changelog.com before commit 7b35e829 Missing Authorization via Preview Routes

Impact

changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items.

Source excerpt · VulnCheck

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

thechangelog · VulnCheck

changelog.com

1 range
VulnCheck version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

0 → before 7b35e82934be93e8b0064299a611c98d55b3e0eb

git versions

unaffected

unknown

Other versions: unaffected

Original source description

changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items.

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification
Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-119763

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-862 ↗

Missing Authorization

VulnCheck

Related →
Contributing organizations · 2
VulnCheck

Assigning organization

2026-10-30
CISA-ADP

Additional data publisher

2026-10-30

What changed

Follow changes
  1. CVE · CVE-2026-119763

    Observed 2026-10-30T19:28:50.011Z · upstream updated 2026-10-30T19:15:19.502Z

    References changed

    before

    [
  "https://github.com/thechangelog/changelog.com/issues/581",
  "https://hackmd.io/@hieund/changelog-com-preview-unpublished-content-missing-authz",
  "https://github.com/thechangelog/changelog.com/commit/7b35e82934be93e8b0064299a611c98d55b3e0eb",
  "https://github.com/thechangelog/changelog.com/blob/73fdd9e19cb609573f9cd8ed195cd9abaeb24f8a/lib/changelog_web/controllers/post_controller.ex#L48-L49",
  "https://github.com/thechangelog/changelog.com",
  "https://www.vulncheck.com/advisories/changelog-com-before-commit-7b35e829-missing-authorization-via-preview-routes"
]

    after

    [
  "https://github.com/thechangelog/changelog.com/issues/581",
  "https://hackmd.io/@hieund/changelog-com-preview-unpublished-content-missing-authz",
  "https://github.com/thechangelog/changelog.com/commit/7b35e82934be93e8b0064299a611c98d55b3e0eb",
  "https://github.com/thechangelog/changelog.com/blob/73fdd9e19cb609573f9cd8ed195cd9abaeb24f8a/lib/changelog_web/controllers/post_controller.ex#L48-L49",
  "https://github.com/thechangelog/changelog.com",
  "https://www.vulncheck.com/advisories/changelog-com-before-commit-7b35e829-missing-authorization-via-preview-routes",
  "https://hackmd.io/@hieund/cve-2026-119763-changelog-com-preview-unpublished-content-missing-authz"
]
    Prioritization updated

    before

    []

    after

    [
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-10-30T19:14:12.861206Z",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "poc"
      },
      {
        "name": "Automatable",
        "value": "yes"
      },
      {
        "name": "Technical Impact",
        "value": "partial"
      }
    ]
  }
]

Large field values are marked as truncated previews. Original source snapshots remain retained.

Showing up to 50 most recent observed changes.

References

7 sources
github.com/thechangelog/changelog.com/commit/7b35e82934be93e8b0064299a611c98d55b3e0eb
patchVulnCheck
github.com/thechangelog/changelog.com/issues/581
issue-trackingVulnCheck
hackmd.io/@hieund/changelog-com-preview-unpublished-content-missing-authz
third-party-advisoryVulnCheck
github.com/thechangelog/changelog.com/blob/73fdd9e19cb609573f9cd8ed195cd9abaeb24f8a/lib/changelog_web/controllers/post_controller.ex
technical-descriptionVulnCheck
github.com/thechangelog/changelog.com
productVulnCheck
www.vulncheck.com/advisories/changelog-com-before-commit-7b35e829-missing-authorization-via-preview-routes
third-party-advisoryVulnCheck
View 1 more references
hackmd.io/@hieund/cve-2026-119763-changelog-com-preview-unpublished-content-missing-authz
exploitCISA-ADP