---
id: CVE-2026-52743
title: GoCD is a continuous deliver server
summary: >-
  GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI
  /jobStatus.json API does not validate that a requested server-assigned job ID
  belongs to the pipeline and stage named in the request. An authenticated user
  can gu…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
  - CWE-863
vendor: gocd
product: gocd
affected:
  - gocd < 26.1.0
published: '2026-09-21'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T20:17:07.593'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-52743'
references:
  - url: >-
      https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a
    label: security-advisories@github.com
  - url: 'https://github.com/gocd/gocd/releases/tag/26.1.0'
    label: security-advisories@github.com
  - url: 'https://github.com/gocd/gocd/security/advisories/GHSA-2x6r-h7h3-wqc4'
    label: security-advisories@github.com
  - url: 'https://www.gocd.org/releases/#26-1-0'
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-25T19:23:41.113607Z'
epss: 0.00342
epssPercentile: 0.2514
ingestedAt: '2026-09-21T14:38:56.367Z'
---

## Overview

GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.