SZB-ca277d5706
EUVD-2026-114240: changelog.com missing authorization reported for unpublished content
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- The Changelog
- Product
- changelog.com
- First seen
Summary
The EUVD listing (CVSS 6.9) says changelog.com before commit 7b35e829 has a missing authorization flaw that lets unauthenticated attackers read unpublished content via preview routes in PostController, NewsIssueController, and NewsItemController. The listing is the only source cited.
If you use The Changelog
Deploy a changelog.com build that includes commit 7b35e829 or later
Review preview routes for exposure of unpublished content
Treat unpublished drafts as potentially visible until patched
What the sources say 1
· Mastodon: “changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController.” Source