CVE-2026-52740

UNKNOWN 0.0

GoCD is vulnerable to pipeline template view API authorization bypass

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline template by name without the required view permission and read its configuration. API operations that modify data are not affected, secure variables remain encrypted, and deployments whose reverse proxy rejects non-uppercase HTTP methods are not affected. This issue is fixed in version 26.1.0.

CWE	CWE-863
Vendor	gocd
Product	gocd
Published	Sep 21, 2026
Last Updated	Sep 21, 2026

Stay Ahead of the Next One

Get instant alerts for gocd gocd

Be the first to know when new unknown vulnerabilities affecting gocd gocd are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

gocd / gocd

>= 18.7.0, < 26.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/gocd/gocd/security/advisories/GHSA-9jfm-4f6v-79wh github.com: https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a github.com: https://github.com/gocd/gocd/releases/tag/26.1.0 gocd.org: https://www.gocd.org/releases/#26-1-0