Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M

CVE-2026-52740GoCD is vulnerable to pipeline template view API authorization bypass

Medium 5.3

In plain English

A medium-severity incorrect authorization in gocd from gocd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.6%top 51.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline template by name without the required view permission and read its configuration. API operations that modify data are not affected, secure variables remain encrypted, and deployments whose reverse proxy rejects non-uppercase HTTP methods are not affected. This issue is fixed in version 26.1.0.

Affected products (as reported)

Vendor	Product	Versions
gocd	gocd	>= 18.7.0, < 26.1.0

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/gocd/gocd/security/advisories/GHSA-9jfm-4f6v-79wh x_refsource_CONFIRM
https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a x_refsource_MISC
https://github.com/gocd/gocd/releases/tag/26.1.0 x_refsource_MISC
https://www.gocd.org/releases/#26-1-0 x_refsource_MISC