CVE-2026-52743

GoCD (a continuous delivery server) prior to version 26.1.0 contains an authorization bypass in its internal /jobStatus.json API. The endpoint fails to validate that a requested server-assigned job ID actually belongs to the pipeline and stage named in the request. An authenticated user can guess...