CVE-2026-55632

Name of the Vulnerable Software and Affected Versions GoCD versions 20.2.0 through 26.0.x

Description An internal pipeline structure API used for autocompletion during the editing of pipeline, template, environment, and user-preference configurations allows regular authenticated users to access the users-and-roles mode without requiring an administrator role. This allows a lower-privileged user to enumerate configured user names and available role names. The endpoint is read-only and does not reveal specific role assignments to individual users.

Recommendations Update to version 26.1.0.