CVE-2026-52740

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline template by name without the required view permission and read its configuration. API operations that modify data are not affected, secure variables remain encrypted, and deployments whose reverse proxy rejects non-uppercase HTTP methods are not affected. This issue is fixed in version 26.1.0.

• CWE-863

• https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a
• https://github.com/gocd/gocd/releases/tag/26.1.0
• https://github.com/gocd/gocd/security/advisories/GHSA-9jfm-4f6v-79wh
• https://www.gocd.org/releases/#26-1-0

Published

Sep 21, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52735ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…9.3
• CVE-2026-52736ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…8.7
• CVE-2026-52737ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…5.3
• CVE-2026-52738ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…6.9
• CVE-2026-52739ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…5.9
• CVE-2026-5274Integer overflow in Codecs in Google Chrome prior to 146.0.7…8.8
• CVE-2026-52741GoCD is a continuous deliver server. From 18.3.0 until 26.1.…7.5
• CVE-2026-52742GoCD is a continuous deliver server. From 12.3.1 until 26.1.…5.1
• CVE-2026-52743GoCD is a continuous deliver server. Prior to 26.1.0, the in…4.3
• CVE-2026-52744GoCD is a continuous deliver server. From 20.2.0 until 26.1.…5.3
• CVE-2026-52745CordysCRM is an open source AI-powered customer relationship…5.3
• CVE-2026-52746JSONata is a JSON query and transformation language. Prior t…7.5