GoCD EUVD-2026-85517

Requires an authenticated GoCD account with lower-than-administrator privileges (PR:L) on a security-enabled GoCD server running an affected version (20.2.0 up to but not including 26.1.0). The attacker queries the internal pipeline-structure autocompletion endpoint (used when editing pipeline, template, environment, or user-preference config), which pre-fix returned userService.allUsernames() and allRoleNames() to any authenticated caller regardless of admin role. Limiting factors: valid credentials are required (not unauthenticated), impact is confined to disclosure of usernames and role names only - no role-to-user mapping, no data modification, and no read of other configuration secrets.

This is a low-severity information-disclosure flaw, and every available signal agrees on that. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3) shows a network-reachable but authenticated (PR:L) issue with confidentiality-only impact and no integrity or availability effect - consistent with the description, which explicitly states the endpoint cannot modify data and does not reveal which roles map to which users. No EPSS score, no CISA KEV listing, and no public exploit code are provided, so there is no evidence of active or automated exploitation; this is a recon-enabler, not a priority patch. The commit diff confirms the root cause (CWE-863 improper authorization): the internal pipeline-structure controller unconditionally called userService.allUsernames()/allRoleNames(), and the fix gates these behind apiAuthorizationHelper.isPipelineGroupAdminOrTemplateAdmin(), returning only the caller's own name and an empty role set otherwise. No signals conflict. The realistic risk is limited: it merely hands an already-authenticated lower-privileged user a roster of usernames and role names to aid follow-on social-engineering or credential-guessing attacks.

A low-privileged but authenticated GoCD user (any regular pipeline user) calls the internal pipeline-structure autocompletion API with the additional-info parameter and receives the full list of configured usernames and role names. The attacker uses this roster to target specific accounts - e.g., password-guessing admin usernames or phishing named users - even though the response does not disclose role-to-user assignments. No public exploit code is identified at time of analysis.