CVE-2026-55632

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode to regular authenticated users without requiring an administrator role. A lower-privileged user can enumerate configured user names and available role names, which can facilitate attacks against those users. The response does not reveal which roles are assigned to each user, and the endpoint cannot modify data. This issue is fixed in version 26.1.0.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/gocd/gocd/commit/c93d9e7b32b64257725a7d1c6f148fb571c86c7e
https://github.com/gocd/gocd/releases/tag/26.1.0
https://github.com/gocd/gocd/security/advisories/GHSA-57pf-j652-c3c9
https://www.gocd.org/releases/#26-1-0

Configurations

No configuration.

History

23 Sep 2026, 19:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-23 19:17

Updated : 2026-09-30 17:23

NVD link : CVE-2026-55632

Mitre link : CVE-2026-55632

CVE.ORG link : CVE-2026-55632

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-55632", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55632", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-23T19:05:08.846854Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gocd", "product": "gocd", "versions": [{"status": "affected", "version": ">= 20.2.0, < 26.1.0"}]}]}], "published": "2026-09-23T19:17:31.733", "references": [{"url": "https://github.com/gocd/gocd/commit/c93d9e7b32b64257725a7d1c6f148fb571c86c7e", "source": "security-advisories@github.com"}, {"url": "https://github.com/gocd/gocd/releases/tag/26.1.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/gocd/gocd/security/advisories/GHSA-57pf-j652-c3c9", "source": "security-advisories@github.com"}, {"url": "https://www.gocd.org/releases/#26-1-0", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode to regular authenticated users without requiring an administrator role. A lower-privileged user can enumerate configured user names and available role names, which can facilitate attacks against those users. The response does not reveal which roles are assigned to each user, and the endpoint cannot modify data. This issue is fixed in version 26.1.0."}], "lastModified": "2026-09-30T17:23:08.953", "sourceIdentifier": "security-advisories@github.com"}