CVE Feed

    Dashboard / CVE / CVE-2026-52740

    CVE-2026-52740

    GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline template by name without the required view permission and read its configuration. API operations that modify data are not affected, secure variables remain encrypted, and deployments whose reverse proxy rejects non-uppercase HTTP methods are not affected. This issue is fixed in version 26.1.0.

    Published:Sep 21, 2026
    Last Modified:Sep 21, 2026
    EPS:Sep 21, 2026
    EPSS Score:
    CVSS Score:5.3

    Affected Products

    Vendor
    Gocd
    Product
    Gocd

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-55632 (CVSS 4.3) — GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for au…
    CVE-2026-52744 (CVSS 5.3) — GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-sugges…
    CVE-2026-52742 (CVSS 5.1) — GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/* expose …
    CVE-2026-55870 (CVSS 2.3) — GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators…
    CVE-2026-55625 (CVSS 4.9) — GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /…
    CVE-2026-55060 (CVSS 3.7) — GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does …
    CVE-2026-52741 (CVSS 7.5) — GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links…
    CVE-2026-68919 (CVSS 7) — GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malic…
    CVE-2026-52743 (CVSS 4.3) — GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not valida…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High