The vulnerability resides in changelog.com before commit 7b35e829, where preview endpoints in multiple controllers lack required authorization checks. The flaw allows an unauthenticated user to enumerate identifiers such as hashid post IDs, sequential newsletter slugs, and integer news item IDs to obtain the content of draft posts, unsent newsletters, and declined news items. This results in exposure of unpublished sensitive information, a direct instance of information disclosure under CWE‑862.

The affected product is thechangelog's changelog.com platform prior to the application of commit 7b35e829. Any deployment using the codebase before that commit is vulnerable; no specific version numbers are provided, so all earlier releases must be considered. Deployments that have been updated to the fixed commit are not affected.

With a CVSS score of 6.9, the vulnerability is deemed moderate to high severity. The EPSS score is not available, and the issue is not listed in CISA KEV, indicating no documented exploitation yet. Based on the description, it is inferred that the likely attack vector is HTTP requests to the preview endpoints, as the vulnerability requires only access to the web interface. Because no authentication is required, the attack can be carried out by any internet user that can guess or brute‑force identifiers, making the risk tangible for exposed deployments.