GoCD EUVD-2026-83941

Requires an authenticated GoCD account with at least minimal access (PR:L) that can reach the internal UI /jobStatus.json endpoint; no user interaction and no special configuration are needed, as the flaw is present in default behavior of all versions prior to 26.1.0. Exploitation is limited by the need for valid credentials and by the fact that the attacker must enumerate/guess server-assigned numeric job IDs (which are sequential and therefore guessable). Impact is bounded to disclosure of job metadata and agent IP/UUID data - console output, artifacts, commands, environment variables, and configuration are not exposed, capping the value of the leak.

This is a low-severity information-disclosure/IDOR issue (CWE-639), and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3) accurately reflects a network-reachable but authenticated flaw with only limited confidentiality impact - no integrity or availability effect, which matches the description (response exposes job metadata but not console output, artifacts, commands, variables, or configuration). No EPSS score, no CISA KEV listing, and no public POC were supplied, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC record provided. This is a genuine but low-priority authorization defect: it leaks operational metadata (job names, state, timestamps, agent IP addresses/UUIDs, associated stages/pipelines) across pipeline authorization boundaries, useful mainly for internal reconnaissance by an already-authenticated GoCD user. It is a routine-patch item, not an emergency. Note the input Tag 'Authentication Bypass' is inaccurate - the vendor advisory and commit show this is a missing per-object authorization check (IDOR), not an authentication bypass; the CVSS PR:L confirms authentication is still required.

An authenticated GoCD user with access to at least one pipeline enumerates or guesses sequential server-assigned numeric job IDs and calls the internal /jobStatus.json API supplying arbitrary pipeline/stage names, since the endpoint never verified the job belonged to the named pipeline and stage. The response returns status metadata for jobs in pipelines the user is not authorized to view, including assigned agent IP addresses and UUIDs. No public exploit code was identified, but the fix commit and test case make the trivial guess-the-jobId technique clear.