{"schema_version":"2","view":"grouped","data":[{"id":3337,"cve_ids":["CVE-2026-52744"],"payload":{"kind":"advisory","title":"GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API","summary":"GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy details and user-defined pipeline, stage, job, and artifact plugin reference names that the user cannot otherwise view in the UI. The endpoint is read-only and does not permit modification of pipeline data. This issue is fixed in version 26.1.0.","evidence":"cve:CVE-2026-52744","products":[{"name":{"value":"gocd","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-52744","aliases":["CVE-2026-52744"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}}],"affected":[{"vendor":"gocd","product":"gocd","versions":[{"status":"affected","version":">= 20.2.0, < 26.1.0"}]}],"modified":"2026-09-29T02:03:59.873Z","provider":"cve","references":["https://github.com/gocd/gocd/security/advisories/GHSA-mvpm-hmc9-2q8p","https://github.com/gocd/gocd/commit/ce9602d7bb27dcb89bf8fc15eb859306cdc8995c","https://github.com/gocd/gocd/releases/tag/26.1.0","https://www.gocd.org/releases/#26-1-0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-52744","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T02:03:51.141165Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:03:59.873Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T17:58:52.039Z"}}},"related_cves":[{"value":"CVE-2026-52744","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:40cd40b6-8d63-4893-8879-3c9e2c458949","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52744","advisory_id":"40cd40b6-8d63-4893-8879-3c9e2c458949","event_types":["advisory"],"published_at":"2026-10-24T21:33:51.864992+00:00","technologies":["core-cve","gocd"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T17:58:52.039+00:00","detail_url":"/advisories/advisory%3A40cd40b6-8d63-4893-8879-3c9e2c458949","group":{"id":"advisory:40cd40b6-8d63-4893-8879-3c9e2c458949","revision":1,"primary_event_id":3350,"change":"published","superseded_by":[],"changed":{"id":3350,"cve_ids":["CVE-2026-52744"],"payload":{"kind":"advisory","title":"GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API","summary":"GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy details and user-defined pipeline, stage, job, and artifact plugin reference names that the user cannot otherwise view in the UI. The endpoint is read-only and does not permit modification of pipeline data. This issue is fixed in version 26.1.0.","evidence":"cve:CVE-2026-52744","products":[{"name":{"value":"gocd","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-52744","aliases":["CVE-2026-52744"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}}],"affected":[{"vendor":"gocd","product":"gocd","versions":[{"status":"affected","version":">= 20.2.0, < 26.1.0"}]}],"modified":"2026-09-29T02:03:59.873Z","provider":"cve","references":["https://github.com/gocd/gocd/security/advisories/GHSA-mvpm-hmc9-2q8p","https://github.com/gocd/gocd/commit/ce9602d7bb27dcb89bf8fc15eb859306cdc8995c","https://github.com/gocd/gocd/releases/tag/26.1.0","https://www.gocd.org/releases/#26-1-0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-52744","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T02:03:51.141165Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:03:59.873Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T17:58:52.039Z"}}},"related_cves":[{"value":"CVE-2026-52744","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:40cd40b6-8d63-4893-8879-3c9e2c458949","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52744","advisory_id":"40cd40b6-8d63-4893-8879-3c9e2c458949","event_types":["advisory"],"published_at":"2026-10-24T21:33:51.864992+00:00","technologies":["core-cve","gocd"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T17:58:52.039+00:00","detail_url":"/events/3350"},"members":[{"id":3350,"cve_ids":["CVE-2026-52744"],"payload":{"kind":"advisory","title":"GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API","summary":"GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy details and user-defined pipeline, stage, job, and artifact plugin reference names that the user cannot otherwise view in the UI. The endpoint is read-only and does not permit modification of pipeline data. This issue is fixed in version 26.1.0.","evidence":"cve:CVE-2026-52744","products":[{"name":{"value":"gocd","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-52744","aliases":["CVE-2026-52744"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}}],"affected":[{"vendor":"gocd","product":"gocd","versions":[{"status":"affected","version":">= 20.2.0, < 26.1.0"}]}],"modified":"2026-09-29T02:03:59.873Z","provider":"cve","references":["https://github.com/gocd/gocd/security/advisories/GHSA-mvpm-hmc9-2q8p","https://github.com/gocd/gocd/commit/ce9602d7bb27dcb89bf8fc15eb859306cdc8995c","https://github.com/gocd/gocd/releases/tag/26.1.0","https://www.gocd.org/releases/#26-1-0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-52744","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T02:03:51.141165Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:03:59.873Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T17:58:52.039Z"}}},"related_cves":[{"value":"CVE-2026-52744","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:40cd40b6-8d63-4893-8879-3c9e2c458949","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52744","advisory_id":"40cd40b6-8d63-4893-8879-3c9e2c458949","event_types":["advisory"],"published_at":"2026-10-24T21:33:51.864992+00:00","technologies":["core-cve","gocd"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T17:58:52.039+00:00","detail_url":"/events/3350"}]}},{"id":2261,"cve_ids":["CVE-2026-68919"],"payload":{"kind":"advisory","title":"GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages","summary":"GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials when rendering the Stage Detail, Job/Build Detail, Value Stream Map, and Pipeline History views. A user with write access to a material tracked by GoCD can store arbitrary HTML or JavaScript in a forged package material comment, which executes in the browser session of a user who later views an affected page. Exploitation requires a victim to view a page that renders the malicious modification, and GoCD does not render every material comment in every view. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.","evidence":"cve:CVE-2026-68919","products":[{"name":{"value":"gocd","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-68919","aliases":["CVE-2026-68919"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}}],"affected":[{"vendor":"gocd","product":"gocd","versions":[{"status":"affected","version":">= 13.3.0, < 26.1.0"}]}],"modified":"2026-09-25T19:25:37.649Z","provider":"cve","references":["https://github.com/gocd/gocd/security/advisories/GHSA-pp5x-wgv2-g37p","https://github.com/gocd/gocd/commit/a03eeeaa4a85edfc9053e743610547d4fcf7aea6","https://github.com/gocd/gocd/releases/tag/26.1.0","https://www.gocd.org/releases/#26-1-0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-68919","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T19:25:29.134231Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:25:37.649Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T14:56:23.341Z"}}},"related_cves":[{"value":"CVE-2026-68919","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4e8af086-a699-4b43-a5a1-318f7824d475","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68919","advisory_id":"4e8af086-a699-4b43-a5a1-318f7824d475","event_types":["advisory"],"published_at":"2026-10-24T21:15:47.618158+00:00","technologies":["core-cve","gocd"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T14:56:23.341+00:00","detail_url":"/advisories/advisory%3A4e8af086-a699-4b43-a5a1-318f7824d475","group":{"id":"advisory:4e8af086-a699-4b43-a5a1-318f7824d475","revision":1,"primary_event_id":2258,"change":"published","superseded_by":[],"changed":{"id":2258,"cve_ids":["CVE-2026-68919"],"payload":{"kind":"advisory","title":"GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages","summary":"GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials when rendering the Stage Detail, Job/Build Detail, Value Stream Map, and Pipeline History views. A user with write access to a material tracked by GoCD can store arbitrary HTML or JavaScript in a forged package material comment, which executes in the browser session of a user who later views an affected page. Exploitation requires a victim to view a page that renders the malicious modification, and GoCD does not render every material comment in every view. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.","evidence":"cve:CVE-2026-68919","products":[{"name":{"value":"gocd","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-68919","aliases":["CVE-2026-68919"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}}],"affected":[{"vendor":"gocd","product":"gocd","versions":[{"status":"affected","version":">= 13.3.0, < 26.1.0"}]}],"modified":"2026-09-25T19:25:37.649Z","provider":"cve","references":["https://github.com/gocd/gocd/security/advisories/GHSA-pp5x-wgv2-g37p","https://github.com/gocd/gocd/commit/a03eeeaa4a85edfc9053e743610547d4fcf7aea6","https://github.com/gocd/gocd/releases/tag/26.1.0","https://www.gocd.org/releases/#26-1-0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-68919","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T19:25:29.134231Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:25:37.649Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T14:56:23.341Z"}}},"related_cves":[{"value":"CVE-2026-68919","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4e8af086-a699-4b43-a5a1-318f7824d475","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68919","advisory_id":"4e8af086-a699-4b43-a5a1-318f7824d475","event_types":["advisory"],"published_at":"2026-10-24T21:15:47.618158+00:00","technologies":["core-cve","gocd"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T14:56:23.341+00:00","detail_url":"/events/2258"},"members":[{"id":2258,"cve_ids":["CVE-2026-68919"],"payload":{"kind":"advisory","title":"GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages","summary":"GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials when rendering the Stage Detail, Job/Build Detail, Value Stream Map, and Pipeline History views. A user with write access to a material tracked by GoCD can store arbitrary HTML or JavaScript in a forged package material comment, which executes in the browser session of a user who later views an affected page. Exploitation requires a victim to view a page that renders the malicious modification, and GoCD does not render every material comment in every view. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.","evidence":"cve:CVE-2026-68919","products":[{"name":{"value":"gocd","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-68919","aliases":["CVE-2026-68919"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}}],"affected":[{"vendor":"gocd","product":"gocd","versions":[{"status":"affected","version":">= 13.3.0, < 26.1.0"}]}],"modified":"2026-09-25T19:25:37.649Z","provider":"cve","references":["https://github.com/gocd/gocd/security/advisories/GHSA-pp5x-wgv2-g37p","https://github.com/gocd/gocd/commit/a03eeeaa4a85edfc9053e743610547d4fcf7aea6","https://github.com/gocd/gocd/releases/tag/26.1.0","https://www.gocd.org/releases/#26-1-0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-68919","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T19:25:29.134231Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:25:37.649Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T14:56:23.341Z"}}},"related_cves":[{"value":"CVE-2026-68919","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4e8af086-a699-4b43-a5a1-318f7824d475","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68919","advisory_id":"4e8af086-a699-4b43-a5a1-318f7824d475","event_types":["advisory"],"published_at":"2026-10-24T21:15:47.618158+00:00","technologies":["core-cve","gocd"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T14:56:23.341+00:00","detail_url":"/events/2258"}]}},{"id":2259,"cve_ids":["CVE-2026-52743"],"payload":{"kind":"advisory","title":"GoCD before 26.1.0 is vulnerable to authorization bypass via job status API","summary":"GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.","evidence":"cve:CVE-2026-52743","products":[{"name":{"value":"gocd","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-52743","aliases":["CVE-2026-52743"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"gocd","product":"gocd","versions":[{"status":"affected","version":"< 26.1.0"}]}],"modified":"2026-09-25T19:23:52.915Z","provider":"cve","references":["https://github.com/gocd/gocd/security/advisories/GHSA-2x6r-h7h3-wqc4","https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a","https://github.com/gocd/gocd/releases/tag/26.1.0","https://www.gocd.org/releases/#26-1-0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-52743","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T19:23:41.113607Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:23:52.915Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T14:24:57.713Z"}}},"related_cves":[{"value":"CVE-2026-52743","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a9f14a16-2ce9-426f-aa71-914b849e6e08","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52743","advisory_id":"a9f14a16-2ce9-426f-aa71-914b849e6e08","event_types":["advisory"],"published_at":"2026-10-24T21:15:46.255276+00:00","technologies":["core-cve","gocd"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T14:24:57.713+00:00","detail_url":"/advisories/advisory%3Aa9f14a16-2ce9-426f-aa71-914b849e6e08","group":{"id":"advisory:a9f14a16-2ce9-426f-aa71-914b849e6e08","revision":1,"primary_event_id":2256,"change":"published","superseded_by":[],"changed":{"id":2256,"cve_ids":["CVE-2026-52743"],"payload":{"kind":"advisory","title":"GoCD before 26.1.0 is vulnerable to authorization bypass via job status API","summary":"GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.","evidence":"cve:CVE-2026-52743","products":[{"name":{"value":"gocd","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-52743","aliases":["CVE-2026-52743"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"gocd","product":"gocd","versions":[{"status":"affected","version":"< 26.1.0"}]}],"modified":"2026-09-25T19:23:52.915Z","provider":"cve","references":["https://github.com/gocd/gocd/security/advisories/GHSA-2x6r-h7h3-wqc4","https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a","https://github.com/gocd/gocd/releases/tag/26.1.0","https://www.gocd.org/releases/#26-1-0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-52743","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T19:23:41.113607Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:23:52.915Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T14:24:57.713Z"}}},"related_cves":[{"value":"CVE-2026-52743","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a9f14a16-2ce9-426f-aa71-914b849e6e08","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52743","advisory_id":"a9f14a16-2ce9-426f-aa71-914b849e6e08","event_types":["advisory"],"published_at":"2026-10-24T21:15:46.255276+00:00","technologies":["core-cve","gocd"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T14:24:57.713+00:00","detail_url":"/events/2256"},"members":[{"id":2256,"cve_ids":["CVE-2026-52743"],"payload":{"kind":"advisory","title":"GoCD before 26.1.0 is vulnerable to authorization bypass via job status API","summary":"GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.","evidence":"cve:CVE-2026-52743","products":[{"name":{"value":"gocd","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-52743","aliases":["CVE-2026-52743"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"gocd","product":"gocd","versions":[{"status":"affected","version":"< 26.1.0"}]}],"modified":"2026-09-25T19:23:52.915Z","provider":"cve","references":["https://github.com/gocd/gocd/security/advisories/GHSA-2x6r-h7h3-wqc4","https://github.com/gocd/gocd/commit/07f9ffd16263e0f626c4b7c0fced1b1b854aab1a","https://github.com/gocd/gocd/releases/tag/26.1.0","https://www.gocd.org/releases/#26-1-0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-52743","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T19:23:41.113607Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:23:52.915Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T14:24:57.713Z"}}},"related_cves":[{"value":"CVE-2026-52743","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a9f14a16-2ce9-426f-aa71-914b849e6e08","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52743","advisory_id":"a9f14a16-2ce9-426f-aa71-914b849e6e08","event_types":["advisory"],"published_at":"2026-10-24T21:15:46.255276+00:00","technologies":["core-cve","gocd"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T14:24:57.713+00:00","detail_url":"/events/2256"}]}},{"id":1946,"cve_ids":["CVE-2026-55625"],"payload":{"kind":"advisory","title":"GoCD is vulnerable to authorization bypass via material connection test APIs","summary":"GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipeline group administrator can invoke Test Connection for source control materials outside the administrator's authorized pipeline group or configuration repository and potentially use credentials from those materials. For GoCD 20.6.0 and later, the test context can also resolve external secrets managed by secret-management plugins, including global reusable secrets with separate permissions. This issue is fixed in version 26.1.0.","evidence":"cve:CVE-2026-55625","products":[{"name":{"value":"gocd","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-55625","aliases":["CVE-2026-55625"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gocd","product":"gocd","versions":[{"status":"affected","version":">= 16.1.0, < 26.1.0"}]}],"modified":"2026-09-24T22:15:30.401Z","provider":"cve","references":["https://github.com/gocd/gocd/security/advisories/GHSA-4557-94j8-5p66","https://github.com/gocd/gocd/commit/f0dda0fb8af4cff5e2f4bf52b753fb41a7ec8918","https://github.com/gocd/gocd/releases/tag/26.1.0","https://www.gocd.org/releases/#26-1-0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-55625","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T22:15:16.505578Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:15:30.401Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T15:00:03.935Z"}}},"related_cves":[{"value":"CVE-2026-55625","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:44f64afc-db2c-4aa8-a800-f7c2ddee45d2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-55625","advisory_id":"44f64afc-db2c-4aa8-a800-f7c2ddee45d2","event_types":["advisory"],"published_at":"2026-10-24T21:10:38.781534+00:00","technologies":["core-cve","gocd"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T15:00:03.935+00:00","detail_url":"/advisories/advisory%3A44f64afc-db2c-4aa8-a800-f7c2ddee45d2","group":{"id":"advisory:44f64afc-db2c-4aa8-a800-f7c2ddee45d2","revision":1,"primary_event_id":1943,"change":"published","superseded_by":[],"changed":{"id":1943,"cve_ids":["CVE-2026-55625"],"payload":{"kind":"advisory","title":"GoCD is vulnerable to authorization bypass via material connection test APIs","summary":"GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipeline group administrator can invoke Test Connection for source control materials outside the administrator's authorized pipeline group or configuration repository and potentially use credentials from those materials. For GoCD 20.6.0 and later, the test context can also resolve external secrets managed by secret-management plugins, including global reusable secrets with separate permissions. This issue is fixed in version 26.1.0.","evidence":"cve:CVE-2026-55625","products":[{"name":{"value":"gocd","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-55625","aliases":["CVE-2026-55625"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gocd","product":"gocd","versions":[{"status":"affected","version":">= 16.1.0, < 26.1.0"}]}],"modified":"2026-09-24T22:15:30.401Z","provider":"cve","references":["https://github.com/gocd/gocd/security/advisories/GHSA-4557-94j8-5p66","https://github.com/gocd/gocd/commit/f0dda0fb8af4cff5e2f4bf52b753fb41a7ec8918","https://github.com/gocd/gocd/releases/tag/26.1.0","https://www.gocd.org/releases/#26-1-0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-55625","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T22:15:16.505578Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:15:30.401Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T15:00:03.935Z"}}},"related_cves":[{"value":"CVE-2026-55625","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:44f64afc-db2c-4aa8-a800-f7c2ddee45d2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-55625","advisory_id":"44f64afc-db2c-4aa8-a800-f7c2ddee45d2","event_types":["advisory"],"published_at":"2026-10-24T21:10:38.781534+00:00","technologies":["core-cve","gocd"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T15:00:03.935+00:00","detail_url":"/events/1943"},"members":[{"id":1943,"cve_ids":["CVE-2026-55625"],"payload":{"kind":"advisory","title":"GoCD is vulnerable to authorization bypass via material connection test APIs","summary":"GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipeline group administrator can invoke Test Connection for source control materials outside the administrator's authorized pipeline group or configuration repository and potentially use credentials from those materials. For GoCD 20.6.0 and later, the test context can also resolve external secrets managed by secret-management plugins, including global reusable secrets with separate permissions. This issue is fixed in version 26.1.0.","evidence":"cve:CVE-2026-55625","products":[{"name":{"value":"gocd","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-55625","aliases":["CVE-2026-55625"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gocd","product":"gocd","versions":[{"status":"affected","version":">= 16.1.0, < 26.1.0"}]}],"modified":"2026-09-24T22:15:30.401Z","provider":"cve","references":["https://github.com/gocd/gocd/security/advisories/GHSA-4557-94j8-5p66","https://github.com/gocd/gocd/commit/f0dda0fb8af4cff5e2f4bf52b753fb41a7ec8918","https://github.com/gocd/gocd/releases/tag/26.1.0","https://www.gocd.org/releases/#26-1-0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-55625","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T22:15:16.505578Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:15:30.401Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T15:00:03.935Z"}}},"related_cves":[{"value":"CVE-2026-55625","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:44f64afc-db2c-4aa8-a800-f7c2ddee45d2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-55625","advisory_id":"44f64afc-db2c-4aa8-a800-f7c2ddee45d2","event_types":["advisory"],"published_at":"2026-10-24T21:10:38.781534+00:00","technologies":["core-cve","gocd"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T15:00:03.935+00:00","detail_url":"/events/1943"}]}},{"id":1944,"cve_ids":["CVE-2026-52741"],"payload":{"kind":"advisory","title":"GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages","summary":"GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-(.+). An attacker with commit access to a tracked material can place URI or HTML special characters in a matching commit comment, causing stored cross-site scripting when a victim views an affected Compare Pipeline page. Deployments without Tracking Tool integration, without an ID capturing group, or with conservative matchers that cannot match special characters are not affected. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.","evidence":"cve:CVE-2026-52741","products":[{"name":{"value":"gocd","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-52741","aliases":["CVE-2026-52741"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gocd","product":"gocd","versions":[{"status":"affected","version":">= 18.3.0, < 26.1.0"}]}],"modified":"2026-09-24T22:13:23.929Z","provider":"cve","references":["https://github.com/gocd/gocd/security/advisories/GHSA-hj3c-q23m-fxcg","https://github.com/gocd/gocd/pull/14356","https://github.com/gocd/gocd/commit/1adba7ded0b9ef57e29f1de876a882199e5da1d4","https://github.com/gocd/gocd/releases/tag/26.1.0","https://www.gocd.org/releases/#26-1-0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-52741","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T22:13:11.846433Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:13:23.929Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T14:57:50.940Z"}}},"related_cves":[{"value":"CVE-2026-52741","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:475310f2-0641-4a54-a073-f3317ca1f3d0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52741","advisory_id":"475310f2-0641-4a54-a073-f3317ca1f3d0","event_types":["advisory"],"published_at":"2026-10-24T21:10:37.273654+00:00","technologies":["core-cve","gocd"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T14:57:50.94+00:00","detail_url":"/advisories/advisory%3A475310f2-0641-4a54-a073-f3317ca1f3d0","group":{"id":"advisory:475310f2-0641-4a54-a073-f3317ca1f3d0","revision":1,"primary_event_id":1941,"change":"published","superseded_by":[],"changed":{"id":1941,"cve_ids":["CVE-2026-52741"],"payload":{"kind":"advisory","title":"GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages","summary":"GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-(.+). An attacker with commit access to a tracked material can place URI or HTML special characters in a matching commit comment, causing stored cross-site scripting when a victim views an affected Compare Pipeline page. Deployments without Tracking Tool integration, without an ID capturing group, or with conservative matchers that cannot match special characters are not affected. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.","evidence":"cve:CVE-2026-52741","products":[{"name":{"value":"gocd","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-52741","aliases":["CVE-2026-52741"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gocd","product":"gocd","versions":[{"status":"affected","version":">= 18.3.0, < 26.1.0"}]}],"modified":"2026-09-24T22:13:23.929Z","provider":"cve","references":["https://github.com/gocd/gocd/security/advisories/GHSA-hj3c-q23m-fxcg","https://github.com/gocd/gocd/pull/14356","https://github.com/gocd/gocd/commit/1adba7ded0b9ef57e29f1de876a882199e5da1d4","https://github.com/gocd/gocd/releases/tag/26.1.0","https://www.gocd.org/releases/#26-1-0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-52741","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T22:13:11.846433Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:13:23.929Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T14:57:50.940Z"}}},"related_cves":[{"value":"CVE-2026-52741","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:475310f2-0641-4a54-a073-f3317ca1f3d0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52741","advisory_id":"475310f2-0641-4a54-a073-f3317ca1f3d0","event_types":["advisory"],"published_at":"2026-10-24T21:10:37.273654+00:00","technologies":["core-cve","gocd"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T14:57:50.94+00:00","detail_url":"/events/1941"},"members":[{"id":1941,"cve_ids":["CVE-2026-52741"],"payload":{"kind":"advisory","title":"GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages","summary":"GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-(.+). An attacker with commit access to a tracked material can place URI or HTML special characters in a matching commit comment, causing stored cross-site scripting when a victim views an affected Compare Pipeline page. Deployments without Tracking Tool integration, without an ID capturing group, or with conservative matchers that cannot match special characters are not affected. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.","evidence":"cve:CVE-2026-52741","products":[{"name":{"value":"gocd","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-52741","aliases":["CVE-2026-52741"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"gocd","product":"gocd","versions":[{"status":"affected","version":">= 18.3.0, < 26.1.0"}]}],"modified":"2026-09-24T22:13:23.929Z","provider":"cve","references":["https://github.com/gocd/gocd/security/advisories/GHSA-hj3c-q23m-fxcg","https://github.com/gocd/gocd/pull/14356","https://github.com/gocd/gocd/commit/1adba7ded0b9ef57e29f1de876a882199e5da1d4","https://github.com/gocd/gocd/releases/tag/26.1.0","https://www.gocd.org/releases/#26-1-0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-52741","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T22:13:11.846433Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:13:23.929Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T14:57:50.940Z"}}},"related_cves":[{"value":"CVE-2026-52741","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:475310f2-0641-4a54-a073-f3317ca1f3d0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52741","advisory_id":"475310f2-0641-4a54-a073-f3317ca1f3d0","event_types":["advisory"],"published_at":"2026-10-24T21:10:37.273654+00:00","technologies":["core-cve","gocd"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T14:57:50.94+00:00","detail_url":"/events/1941"}]}}],"next_after":3337,"next_before":1944}