EUVD-2026-83954

GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/ expose historical full server configuration to pipeline group administrators instead of restricting responses to configuration for groups they administer. The disclosed configuration can include...

CVE-2026-52742

GoCD (continuous delivery server) versions 12.3.1 through 26.1.0 are affected by an authorization bypass in legacy routes under /go/admin/restful/*. These routes expose the full historical server configuration to pipeline group administrators rather than restricting responses to only the groups t...

PT-2026-96132

Name of the Vulnerable Software and Affected Versions GoCD versions 12.3.1 through 26.0.x Description Legacy routes under the endpoint '/go/admin/restful/' expose the full historical server configuration to pipeline group administrators. This occurs because the system fails to restrict responses ...