CVE-2026-119763 changelog.com before commit 7b35e829 Missing Authorization via Preview Routes
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119763?
CVE-2026-119763 is a medium-severity vulnerability in thechangelog changelog.com, published on 30 Oct 2026.
Official description
changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items.
Weakness: CWE-862
Which versions are affected by CVE-2026-119763?
How do I fix CVE-2026-119763?
No fix has been published for CVE-2026-119763 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119763 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-119763 exists.
Sources
Also known as GHSA-m43r-rq77-95gx.