CVE-2026-52743

GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.

• CWE-639
• CWE-863

• https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a
• https://github.com/gocd/gocd/releases/tag/26.1.0
• https://github.com/gocd/gocd/security/advisories/GHSA-2x6r-h7h3-wqc4
• https://www.gocd.org/releases/#26-1-0

Published

Sep 21, 2026

Last Modified

Sep 25, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52738ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…6.9
• CVE-2026-52739ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…5.9
• CVE-2026-5274Integer overflow in Codecs in Google Chrome prior to 146.0.7…8.8
• CVE-2026-52740GoCD is a continuous deliver server. From 18.7.0 until 26.1.…5.3
• CVE-2026-52741GoCD is a continuous deliver server. From 18.3.0 until 26.1.…7.5
• CVE-2026-52742GoCD is a continuous deliver server. From 12.3.1 until 26.1.…5.1
• CVE-2026-52744GoCD is a continuous deliver server. From 20.2.0 until 26.1.…5.3
• CVE-2026-52745CordysCRM is an open source AI-powered customer relationship…5.3
• CVE-2026-52746JSONata is a JSON query and transformation language. Prior t…7.5
• CVE-2026-52747ModSecurity is an open source, cross platform web applicatio…8.6
• CVE-2026-5275Heap buffer overflow in ANGLE in Google Chrome on Mac prior …8.8
• CVE-2026-52750Ghidra before 12.1 contains a command injection vulnerabilit…8.4