Vulnerability · Published Sep 23, 2026 · Assigned by GitHub_M

CVE-2026-55632GoCD is vulnerable to authorization bypass via pipeline structure API

Medium 4.3

In plain English

A medium-severity incorrect authorization in gocd from gocd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 65.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode to regular authenticated users without requiring an administrator role. A lower-privileged user can enumerate configured user names and available role names, which can facilitate attacks against those users. The response does not reveal which roles are assigned to each user, and the endpoint cannot modify data. This issue is fixed in version 26.1.0.

Affected products (as reported)

Vendor	Product	Versions
gocd	gocd	>= 20.2.0, < 26.1.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/gocd/gocd/security/advisories/GHSA-57pf-j652-c3c9 x_refsource_CONFIRM
https://github.com/gocd/gocd/commit/c93d9e7b32b64257725a7d1c6f148fb571c86c7e x_refsource_MISC
https://github.com/gocd/gocd/releases/tag/26.1.0 x_refsource_MISC
https://www.gocd.org/releases/#26-1-0 x_refsource_MISC