CVE-2026-52743

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-52743
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52743.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-52743
Aliases
  • GHSA-2x6r-h7h3-wqc4
Published
2026-09-21T14:24:57Z
Modified
2026-09-26T03:45:59Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
GoCD before 26.1.0 is vulnerable to authorization bypass via job status API
Details

GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-639",
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52743.json"
}
References

Affected packages

Git / github.com/gocd/gocd

Affected ranges

Type
GIT
Repo
https://github.com/gocd/gocd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
07f9ffd16263e0f626c4b7c0fced1b1b854aab1a
Fixed
55b7b460510bb739c1ae6d226ff7fb650596dca2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "26.1.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

14.*
14.2.0
14.3.0
14.4.0
15.*
15.1.0
15.2.0
15.3.0
16.*
16.1.0
16.10.0
16.11.0
16.12.0
16.2.0
16.3.0
16.4.0
16.5.0
16.6.0
16.7.0
16.8.0
16.9.0
17.*
17.1.0
17.10.0
17.11.0
17.12.0
17.2.0
17.3.0
17.4.0
17.5.0
17.6.0
17.7.0
17.8.0
17.9.0
18.*
18.1.0
18.10.0
18.11.0
18.12.0
18.2.0
18.3.0
18.4.0
18.5.0
18.6.0
18.7.0
18.8.0
18.9.0
19.*
19.1.0
19.10.0
19.11.0
19.12.0
19.2.0
19.3.0
19.4.0
19.5.0
19.6.0
19.7.0
19.8.0
19.9.0
20.*
20.1.0
20.10.0
20.2.0
20.3.0
20.4.0
20.5.0
20.6.0
20.7.0
20.8.0
20.9.0
21.*
21.1.0
21.2.0
21.3.0
21.4.0
22.*
22.1.0
22.2.0
22.3.0
23.*
23.1.0
23.2.0
23.3.0
23.4.0
23.5.0
24.*
24.1.0
24.2.0
24.3.0
24.4.0
24.5.0
25.*
25.1.0
25.2.0
25.3.0
25.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52743.json"