GoCD CVE-2026-52740

Requires a valid authenticated GoCD account at a lower privilege level that lacks view permission on the target pipeline template (PR:L), against GoCD versions 18.7.0 through before 26.1.0. The attacker sends a request to the Get Template Config API using nonstandard HTTP method capitalization (e.g. 'Get' rather than 'GET') to evade the case-sensitive authorization before-filter. Exploitation is fully blocked in deployments whose reverse proxy normalizes or rejects non-uppercase HTTP methods, and impact is limited to reading template configuration - data-modifying API operations are not affected and secure variables remain encrypted.

This is a genuine but low-severity broken-authorization issue, not a high-CVSS-low-real-risk inflation case - the vendor 4.0 score of 5.3 is appropriately modest and matches the impact. All signals point the same direction: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L, VI:N/VA:N) confirms network-reachable, low-complexity, but requires an already-authenticated low-privileged account and yields only limited confidentiality loss (read access to pipeline template configuration). No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input - absence of these is expected for a niche OSS CI/CD product and is not itself a red flag. No public exploit identified at time of analysis. The commit diff (614d694c) independently confirms the root cause: authorization before-filters were selected via case-sensitive HTTP method comparison (Set.of("PUT","POST","PATCH").contains(method.toUpperCase()) and Set.of(allowedMethods).contains(request.requestMethod())), so a request with nonstandard capitalization slipped past the filter. Two mitigating factors materially lower real-world risk: exploitation requires a valid authenticated account (PR:L) and is entirely defeated by any reverse proxy that rejects non-uppercase HTTP methods. Net: patch during a normal cycle rather than emergency, prioritize higher for multi-tenant GoCD instances with many low-trust users.

A low-privileged authenticated GoCD user who lacks view permission on a pipeline template issues a request to the Get Template Config API using nonstandard HTTP method capitalization (e.g. 'Get' instead of 'GET'). Because the authorization before-filter matches methods case-sensitively, the check is skipped and the server returns the template's configuration. No public exploit code is identified; given the trivial nature of the trick (altering method case), it is low-complexity to reproduce for anyone with account access.