Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M

CVE-2026-52743GoCD before 26.1.0 is vulnerable to authorization bypass via job status API

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in gocd from gocd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 65.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.

Affected products (as reported)

Vendor	Product	Versions
gocd	gocd	< 26.1.0

Weakness: CWE-639, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/gocd/gocd/security/advisories/GHSA-2x6r-h7h3-wqc4 x_refsource_CONFIRM
https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a x_refsource_MISC
https://github.com/gocd/gocd/releases/tag/26.1.0 x_refsource_MISC
https://www.gocd.org/releases/#26-1-0 x_refsource_MISC