GoCD EUVD-2026-85516

Requires a valid authenticated GoCD account (PR:L) on a server running an affected version (20.2.0 through pre-26.1.0). The attacker calls the internal UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream. Exploitation is meaningful only in deployments where pipeline visibility is restricted per user/team, so that the leaked dependency hierarchy and reference names exceed the user's granted view permissions; in a single-team or fully-visible install there is nothing extra to disclose. The endpoint is read-only, so impact is limited to disclosure of pipeline topology and reference names - no data modification, credential, or artifact-content exposure. No user interaction or non-default configuration is required beyond having security/authorization enabled.

This is a genuine but low-severity information-disclosure issue, correctly rated at the lower-middle of the scale. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N, 5.3) is internally consistent with the description and the fix commit: an authenticated low-privilege user (PR:L) can reach a read-only internal API over the network with no user interaction and obtain a confidentiality-only leak (VC:L, VI:N/VA:N - read-only, no modification). My independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, ~4.3) agrees. There is no EPSS score, no CISA KEV listing, and no public POC provided, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision block was supplied. The disclosed data is metadata (pipeline/stage/job/artifact reference names and inter-pipeline dependency structure) rather than credentials, source, or artifact contents, so real-world impact is limited to reconnaissance/leak of pipeline topology across authorization boundaries. This is a real priority only in multi-tenant GoCD deployments where pipeline visibility is intentionally segmented between teams; in single-team installs the practical risk is negligible. No signals conflict: the CVSS vector, CWE-862 (missing authorization), and the commit (adding checkPipelineOrTemplateViewPermissionsAnd403 and per-pipeline hasViewPermissionForPipeline checks) all point to the same authorization-gap conclusion.

An authenticated GoCD user who has been granted visibility to only a subset of pipelines sends a GET request to the internal fetch-artifact auto-suggestion endpoint /go/api/internal/pipelines/**/upstream. Because the endpoint only enforced generic authentication rather than per-pipeline view authorization, the response reveals upstream dependency hierarchies and pipeline/stage/job/artifact reference names the user is not permitted to see in the UI, enabling cross-team reconnaissance. No public proof-of-concept was provided, but the fix commit and its added security tests demonstrate the exact gap.