Missing authorization in changelog.com exposes unpublished content
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
changelog.com before commit 7b35e829 has a missing authorization check (CWE-862) on its preview routes. An unauthenticated remote attacker can read unpublished content, including draft posts, unsent newsletters and declined news items, by guessing post, newsletter and news IDs.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
No affected products listed by the sources yet.
Remediation
The sources list no fixed version for changelog.com.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Timeline
- 2026-10-30 Threatist record created from CVE-2026-119763
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: MEDIUM → HIGH
- 2026-10-30 Alias added: GHSA-m43r-rq77-95gx
References
Patch 1
Sources
- CVE-2026-119763 · CVE Program
- CVE-2026-119763 · NVD
- FIRST EPSS
- GHSA-m43r-rq77-95gx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences