CVE-2026-119763 json
changelog.com before commit 7b35e829 Missing Authorization via Preview Routes
published 2026-10-30 10 d ago modified 2026-10-30 9 d ago also EUVD-2026-114240
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 9 d ago
Exploit prediction
0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- hackmd.io https://hackmd.io/@hieund/cve-2026-119763-changelog-com-preview-unpublished-content-missing-authz referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- thechangelog changelog.com
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/thechangelog/changelog.com/commit/7b35e82934be93e8b0064299a611c98d55b3e0eb
patch
-
hackmd.io
/@hieund/cve-2026-119763-changelog-com-preview-unpublished-content-missing-authz
exploit
-
github.com
/thechangelog/changelog.com/issues/581
issue-tracking
-
hackmd.io
/@hieund/changelog-com-preview-unpublished-content-missing-authz
third-party-advisory
-
github.com
/thechangelog/changelog.com/blob/73fdd9e19cb609573f9cd8ed195cd9abaeb24f8a/lib/changelog_web/controllers/post_c
technical-description
-
github.com
/thechangelog/changelog.com
product
-
vulncheck.com
/advisories/changelog-com-before-commit-7b35e829-missing-authorization-via-preview-routes
third-party-advisory
Sources
- CVE List CVE-2026-119763
- NVD CVE-2026-119763
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.