EUVD-2026-114240
GHSA-m43r-rq77-95gx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover preview/show endpoints
-
ExploitEnumerate hashid, slug and integer IDs
-
ImpactRetrieve unpublished drafts and newsletters
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of changelog.com, since the preview routes in PostController, NewsIssueController and NewsItemController lacked any admin check before commit 7b35e829. The only practical limiting factor is identifier guessing: post IDs are hashid-encoded (mild obscurity), while newsletter slugs are sequential and news IDs are plain integers, making enumeration straightforward. Impact is further limited to read-only disclosure of unpublished content (draft posts, unsent newsletters, declined news items) - no write, modification, or availability impact. Fixed by updating to a build including commit 7b35e82934be93e8b0064299a611c98d55b3e0eb, which enforces the RequireAdminPreview plug. |
| Impact | This is a genuine but low-to-moderate confidentiality issue, not a top-tier emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) shows remote, unauthenticated, low-complexity access with no user interaction, but impact is confined to confidentiality at Low (VC:L; VI:N/VA:N) - attackers read unpublished content only, with no integrity or availability effect. The vuln.today Decision label is 'monitor', the lowest urgency tier, which aligns with the limited impact. No KEV entry is present, so exploitation status is 'no public exploit identified at time of analysis' for working exploit code; however, a public write-up (hackmd) and a GitHub issue are referenced, so a public PoC/analysis reference exists but is not verified as working exploit code. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be stated. The signals are internally consistent: easy-to-reach but low-consequence. The practical risk is information disclosure of draft posts, unsent newsletters and declined news items - reputationally and editorially sensitive for a publisher, but not a system-compromise vector. |
| Exploit ScenarioDerived | An unauthenticated attacker requests the preview routes of changelog.com and iterates identifiers - hashid-encoded post IDs, sequential newsletter slugs and integer news IDs - against the PostController, NewsIssueController and NewsItemController preview/show endpoints. Because no admin check guarded these actions before commit 7b35e829, the server returns draft posts, unsent newsletters and declined news items. A public analysis write-up describing the technique exists, though no verified working exploit code is confirmed in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Unauthenticated attackers can read unpublished changelog.com content - draft posts, unsent newsletters and declined news items - by requesting the site's editorial preview actions, which in builds before commit 7b35e829 performed no admin or authorization check. Any remote user can enumerate identifiers (hashid-encoded post IDs, sequential newsletter slugs, plain integer news IDs) against the preview endpoints and retrieve material that was never meant to be public. Rated CVSS 6.9 with confidentiality-only impact (no integrity or availability effect), it is not listed in CISA KEV and no public exploit code has been identified at time of analysis, though a public researcher writeup describing the enumeration approach exists; the vuln.today decision label is monitor, so this is a genuine but low-to-moderate disclosure issue rather than an emergency. No EPSS score was supplied in the available intelligence.
RemediationAI
Deploy a changelog.com build that includes commit 7b35e82934be93e8b0064299a611c98d55b3e0eb (https://github.com/thechangelog/changelog.com/commit/7b35e82934be93e8b0064299a611c98d55b3e0eb), which wires ChangelogWeb.Plug.RequireAdminPreview into the preview action of PostController, NewsIssueController and NewsItemController, sets no-store/private cache headers on preview responses, and gates draft resolution in EpisodeController.play/img; the vendor advisory is at https://www.vulncheck.com/advisories/changelog-com-before-commit-7b35e829-missing-authorization-via-preview-routes and the tracked issue at https://github.com/thechangelog/changelog.com/issues/581. No tagged release version is named in the available data, so confirm the deployed revision rather than a version string. If the patch cannot be applied immediately, the specific compensating control is to block the editorial preview routes at the reverse proxy or CDN for unauthenticated traffic and allow them only from an allowlisted admin network or an authenticated session; the trade-off is that editors lose remote preview access outside the allowlist. Because the fix also strips surrogate-key and adds no-store, treat previously served preview responses as potentially cached by shared infrastructure and purge CDN caches for the affected routes; the trade-off is a broader cache invalidation that may temporarily increase origin load. Rotating or changing the hashid salt and re-slugging unpublished newsletter identifiers would reduce the enumerability that makes this exploitable, but it is disruptive to existing links and does not replace the authorization fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
changelog.com is an Elixir/Phoenix application, and the flaw is a textbook CWE-862 Missing Authorization case: the preview actions exposed by ChangelogWeb.PostController, ChangelogWeb.NewsIssueController and ChangelogWeb.NewsItemController rendered draft content without ever consulting the authenticated user's admin flag. The upstream fix introduces ChangelogWeb.Plug.RequireAdminPreview, a Phoenix plug applied to the preview action in each controller, which permits the request only when conn.assigns[:current_user] matches %{admin: true} and otherwise responds 404 and halts the connection. The same plug also strips surrogate-key and sets cache-control: private, no-store, must-revalidate plus surrogate-control: no-store, indicating that preview responses could previously be retained by a shared/CDN cache layer. The commit additionally hardens adjacent asset paths: EpisodeController.play/img previously resolved episodes by slug straight from the database, so the patch adds assign_asset_episode, which first looks up a published episode and only falls back to a draft when RequireAdminPreview allows it; NewsItemController.show was likewise restructured to distinguish a news episode from a news item lookup rather than relying on a rescue-based fallback. Exploitation is trivial in mechanism - the trigger is simply an HTTP GET to a preview route - and the only friction is identifier guessing: post IDs are hashid-encoded (mild obscurity), whereas newsletter slugs are sequential and news IDs are plain integers, making enumeration straightforward.
Know when Changelog Com gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Remote unauthenticated preview routes (AV:N/AC:L/PR:N/UI:N); only unpublished content is disclosed, so C:L with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB