CVE-2026-55060

GoCD , a continuous delivery server, has an authorization bypass in the /go/api/support/process_list endpoint from versions 13.1.0 through 26.1.0 . The endpoint does not enforce its intended administrator-only authorization, allowing an authenticated internal user to view command-line arguments, ...

CVE-2026-55060 GoCD is vulnerable to authorization bypass via support process list API

GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/processlist endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line...