Missing Authorization Vulnerability in Changelog.com by The Changelog

CVE-2026-119763

What is CVE-2026-119763?

Changelog.com is susceptible to a missing authorization vulnerability that enables malicious actors to gain unauthorized access to unpublished content through specific preview routes. This issue affects the PostController, NewsIssueController, and NewsItemController, permitting attackers to enumerate hash ID post IDs, sequential newsletter slugs, and integer news IDs against these endpoints. By exploiting this vulnerability, attackers can read draft posts, unsent newsletters, and declined news items, posing a significant risk to content security and privacy.

References