Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-52743 Details

Description

GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:4.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a [email protected]
https://github.com/gocd/gocd/releases/tag/26.1.0 [email protected]
https://github.com/gocd/gocd/security/advisories/GHSA-2x6r-h7h3-wqc4 [email protected]
https://www.gocd.org/releases/#26-1-0 [email protected]

Weakness Enumeration

CWE-IDCWE NameSource
CWE-639Authorization Bypass Through User-Controlled Key[email protected]
CWE-863Incorrect Authorization[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

2 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-52743
NVD Published Date:
Sep 21, 2026
NVD Last Modified:
Sep 25, 2026
Source:
[email protected]
CVE-2026-52743 Details - Not Deferred