CVE-2026-52743

Name of the Vulnerable Software and Affected Versions GoCD versions prior to 26.1.0

Description The internal GoCD UI '/jobStatus.json' API fails to validate if a requested server-assigned job ID belongs to the specified pipeline and stage. This allows an authenticated user to guess job IDs and retrieve status information for jobs in pipelines they are not authorized to view. Exposed data includes job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not include console output, artifacts, commands, variables, or configuration.

Recommendations Update to version 26.1.0.