GoCD EUVD-2026-83952

Requires an authenticated GoCD user holding pipeline-group administrator (or config-repo administrator) privileges on a server running 16.1.0 through 26.0.x; the attacker calls /go/api/admin/internal/material_test or /go/api/internal/config_repos/*/material_test and supplies an arbitrary existing pipeline and pipeline-group name outside their authorized scope. Impact is amplified on GoCD 20.6.0 and later, where the test context resolves external secrets managed by secret-management plugins, including global reusable secrets with separate permissions. Limiting factors: exploitation is meaningful only in multi-tenant deployments where distinct teams/groups must be isolated - in a single-team install where all admins are mutually trusted there is no real privilege boundary crossed; PR:H means no anonymous or low-privilege user can exploit it, and no user interaction is required.

This is a moderate-severity broken-authorization (IDOR) flaw, not a high-priority emergency. The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) is internally consistent with the description: network-reachable, low attack complexity, but gated behind PR:H because the attacker must already be an authenticated GoCD pipeline-group administrator. The confidentiality-only impact (C:H, I:N, A:N) correctly reflects that the flaw discloses/abuses credentials and secrets from materials outside the attacker's authorized scope but does not directly modify or deny service. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic risk is therefore an insider/privilege-boundary problem: a semi-trusted pipeline-group admin escalating access to secrets belonging to other groups or global reusable secrets (on 20.6.0+). CWE-639 is the accurate weakness; the input Tag 'Authentication Bypass' is misleading because authentication is NOT bypassed - a valid privileged session is required and only authorization scoping is violated. This should be prioritized in multi-tenant GoCD deployments where distinct teams share one server but must not share secrets; it is low priority in single-team installations where all admins are already mutually trusted.

A pipeline-group administrator in a shared multi-tenant GoCD server crafts a POST to /go/api/admin/internal/material_test (or the config-repo variant), supplying an existing pipeline/pipeline-group name belonging to a different team along with an SCM material config. GoCD performs the Test Connection using the out-of-scope context, and on GoCD 20.6.0+ resolves external secrets - including global reusable secrets - allowing the attacker to leverage credentials they were never authorized to use. No public exploit code is identified, but the attack is a single authenticated API request with low complexity.