GoCD EUVD-2026-83950

Requires an authenticated internal GoCD user account (the description states an 'authenticated internal user,' contradicting the vector's PR:N). Exploitation is further limited by a timing race: the /go/api/support/process_list endpoint only leaks material metadata while source-control child processes are actively running, so the attacker must query during that unpredictable window (matching CVSS AC:H). Disclosure is bounded - credentials, environment variables, and user-defined secrets are masked or omitted, so only command-line arguments, usernames, remote material URLs, and internal material paths are exposed. Affects GoCD 13.1.0 through versions before 26.1.0; fixed in 26.1.0.

This is a genuinely low-priority issue despite being an authorization flaw. The vendor CVSS of 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects information disclosure only, with no integrity or availability impact. All three exploitation-likelihood signals are quiet: no EPSS score is provided, KEV status is NO (not in CISA KEV), and no public POC is referenced - so exploitation status is 'no public exploit identified at time of analysis.' There is also a notable internal conflict: the CVSS vector encodes PR:N (unauthenticated), but the description explicitly states 'An authenticated internal user' can query the endpoint - verify with vendor, but the description strongly implies PR:L (authenticated), which is corroborated by the fix adding an admin-user authorization check. The AC:H rating is well-justified because exploitation depends on unpredictable timing (the attacker must query while source-control child processes are actively running), and the leaked data is bounded - credentials, environment variables, and user-defined secrets remain masked or omitted. Net: a real but minor confidentiality gap for lower-privileged authenticated users, not an urgent patch.

A logged-in low-privilege GoCD user repeatedly polls /go/api/support/process_list hoping to catch a moment when source-control child processes (e.g., a git/svn material fetch) are executing. If timed correctly, the response reveals command-line arguments, usernames, remote material URLs, and internal material paths for materials the user is not otherwise authorized to see. No public exploit code is identified, and success is unreliable due to the process-timing race.