https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-01T00:52:52.674402+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-52744 CVE-2026-52744 — GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API 2026-10-01T00:52:52.687241+00:00

Affected: gocd

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy details and user-defined pipeline, stage, job, and artifact plugin reference names that the user cannot otherwise view in the UI. The endpoint is read-only and does not permit modification of pipeline data. This issue is fixed in version 26.1.0.