{"id":"CVE-2026-52740","summary":"GoCD is vulnerable to pipeline template view API authorization bypass","details":"GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline template by name without the required view permission and read its configuration. API operations that modify data are not affected, secure variables remain encrypted, and deployments whose reverse proxy rejects non-uppercase HTTP methods are not affected. This issue is fixed in version 26.1.0.","aliases":["GHSA-9jfm-4f6v-79wh"],"modified":"2026-09-23T08:15:48.210870Z","published":"2026-09-21T14:59:15.786Z","database_specific":{"cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52740.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/gocd/gocd/releases/tag/26.1.0"},{"type":"WEB","url":"https://www.gocd.org/releases/#26-1-0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52740.json"},{"type":"ADVISORY","url":"https://github.com/gocd/gocd/security/advisories/GHSA-9jfm-4f6v-79wh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52740"},{"type":"FIX","url":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gocd/gocd","events":[{"introduced":"75d1247f58ab8bcde3c5b43392a87347979f82c5"},{"fixed":"614d694c6d9d8714517db8f9f1581cc1c140506a"},{"fixed":"55b7b460510bb739c1ae6d226ff7fb650596dca2"}],"database_specific":{"extracted_events":[{"introduced":"18.7.0"},{"fixed":"26.1.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["25.4.0","25.3.0","25.2.0","25.1.0","24.5.0","24.4.0","24.3.0","24.2.0","24.1.0","23.5.0","23.4.0","23.3.0","23.2.0","23.1.0","22.3.0","22.2.0","22.1.0","21.4.0","21.3.0","21.2.0","21.1.0","20.10.0","20.9.0","20.8.0","20.7.0","20.6.0","20.5.0","20.4.0","20.3.0","20.2.0","20.1.0","19.12.0","19.11.0","19.10.0","19.9.0","19.8.0","19.7.0","19.6.0","19.5.0","19.4.0","19.3.0","19.2.0","19.1.0","18.12.0","18.11.0","18.10.0","18.9.0","18.8.0","18.7.0"],"database_specific":{"vanir_signatures_modified":"2026-09-23T08:15:48Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"164393759582334346651275302721640510991","length":99},"id":"CVE-2026-52740-08133db4","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a","target":{"file":"api/api-base/src/main/java/com/thoughtworks/go/api/ApiController.java","function":"setMultipartUpload"}},{"deprecated":false,"digest":{"line_hashes":["23106156625874585062169197514776666039","272886987405104048865003318002543196235","278672799419391427670217071912681694522","99793023533661016266717491058340328786","299504076254951852191832368574439519842","51954220052140558074335416893056033297","152053190811917623805703532516429024682","49727394237545543631977974267780898648","113088237201545440404319630626547687777","88509678824923195038834235748981988476"],"threshold":0.9},"id":"CVE-2026-52740-0e8873d8","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a","target":{"file":"spark/spark-base/src/main/java/com/thoughtworks/go/spark/SparkController.java"}},{"source":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a","target":{"file":"spark/spark-base/src/main/java/com/thoughtworks/go/spark/spring/RouteEntry.java","function":"isAPI"},"deprecated":false,"digest":{"function_hash":"166296450795468483478980872355244317409","length":174},"id":"CVE-2026-52740-1720df16","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["293644107583814706305313834881514248581","43526100860380261015420273856821442599","157233936825244187698220557484897351053"]},"id":"CVE-2026-52740-1edf0217","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/55b7b460510bb739c1ae6d226ff7fb650596dca2","target":{"file":"server/src/test/java/com/thoughtworks/go/server/service/ConsoleServiceTest.java"}},{"signature_version":"v1","source":"https://github.com/gocd/gocd/commit/55b7b460510bb739c1ae6d226ff7fb650596dca2","target":{"file":"server/src/test/java/com/thoughtworks/go/server/service/ConsoleServiceTest.java","function":"shouldReturnUsefulErrorIfMoveConsoleArtifactsFails"},"deprecated":false,"digest":{"function_hash":"250222003766494194465964995240362262739","length":800},"id":"CVE-2026-52740-27d5397f","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["38771258555525496280364132767010392697","77064376400510894845692497527010175481","57435296091957921389259827822123870300","104273936234290854458728416675886066698"],"threshold":0.9},"id":"CVE-2026-52740-2c934fd3","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a","target":{"file":"api/api-plugin-images/src/main/java/com/thoughtworks/go/api/pluginimages/PluginImagesController.java"}},{"digest":{"line_hashes":["48641310032374652173733552332364689344","109478149295124471267336575711884617889","58104110657883947900887752589609710409","78391500584254355365909221986420623780","47081780562710979575318400205872720133","289283500895312908821305396908403317158","38965087205558800720031350924356422267","312949377132371368955661022852036892057","27596722131798805523886064897868223983","33389276543329654220095817896981579096","295352357592563048332165488126495294885"],"threshold":0.9},"id":"CVE-2026-52740-36d40f6d","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a","target":{"file":"api/api-template-config-v7/src/main/java/com/thoughtworks/go/apiv7/admin/templateconfig/TemplateConfigControllerV7.java"},"deprecated":false},{"digest":{"line_hashes":["48641310032374652173733552332364689344","109478149295124471267336575711884617889","75541841599013500455465963559501004963","292927150501516638869613001939805434063","179077737272182502366318469523764959079","219588236863933931129927872782153076850","55775713105650840713249485280478088847","45937022724140041389642009313346399151","192583521375453913961168176171253951150"],"threshold":0.9},"id":"CVE-2026-52740-480d0144","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a","target":{"file":"api/api-pipeline-groups-v1/src/main/java/com/thoughtworks/go/apiv1/admin/pipelinegroups/PipelineGroupsControllerV1.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a","target":{"file":"api/api-base/src/main/java/com/thoughtworks/go/api/ApiController.java","function":"onlyOn"},"deprecated":false,"digest":{"function_hash":"317808285017307722539573638342082079405","length":207},"id":"CVE-2026-52740-5e29279f","signature_type":"Function"},{"digest":{"line_hashes":["290730851216290548291809033880285075232","220903542472111654462688541918183620260","329513306548584424067731181272302248806","33447400154710961199967559674498713580"],"threshold":0.9},"id":"CVE-2026-52740-70f25f3e","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a","target":{"file":"server/src/main/java/com/thoughtworks/go/server/newsecurity/filters/RememberLastRequestUrlFilter.java"},"deprecated":false},{"digest":{"function_hash":"205686126707678844256996826269785804015","length":806},"id":"CVE-2026-52740-70f61c45","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a","target":{"file":"api/api-plugin-images/src/main/java/com/thoughtworks/go/api/pluginimages/PluginImagesController.java","function":"show"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"187410573084951694364523401296161738907","length":553},"id":"CVE-2026-52740-766a851d","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a","target":{"file":"api/api-base/src/main/java/com/thoughtworks/go/api/ApiController.java","function":"verifyContentType"}},{"source":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a","target":{"function":"setupRoutes","file":"api/api-pipeline-groups-v1/src/main/java/com/thoughtworks/go/apiv1/admin/pipelinegroups/PipelineGroupsControllerV1.java"},"deprecated":false,"digest":{"function_hash":"147532876559712335212581987791387391488","length":1021},"id":"CVE-2026-52740-8a954a62","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a","target":{"file":"spark/spark-base/src/main/java/com/thoughtworks/go/spark/spring/RouteEntry.java"},"deprecated":false,"digest":{"line_hashes":["175311621342228281262844091459779911323","128221825690398409242932558779378720702","263991643074757263337155141268055293898","339663703186429108183975814530158485664","45018259694652864027184148480287194258","157531080260574072479030247308956174913","288787292049242112436759787921918791306"],"threshold":0.9},"id":"CVE-2026-52740-9bd5e168"},{"deprecated":false,"digest":{"line_hashes":["280345982475444026474299332026001469132","144333624021763528570121583427998702002","287039846370791488630247101901954287960","12896525014386530499092111968363671446","115994799278443540418434404869276552096","313508066203896308412218993262150579267","217073984665250453112364663762767494059","18728782507587789094307628443950508555","152643591674016647159728371700617471263","119891514431608965773776442327040416122","289976031417861944782232949122644661555","149845531197953701554751481257646526721","163731824104703056970410624438153190426","73637172545033124391065123378294109733","107334168511388226746461501915808733267","305089321203520134620276053895420121071","25882109528339361657225627981413338059","161761904852338628165654055439082555948","92405303431767836468750101817148859411","74002471220012461798416178516968151556","10492933163417035144169904433970757214","151355920742328996898022672943071881188","149179917387333167579723318027631973654","136914798260052061760527264308555750438","95595399738156940055375159127433431301","261593513411573144501337096179820877389","83067846577267379275426746723941928913"],"threshold":0.9},"id":"CVE-2026-52740-a53aa490","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a","target":{"file":"api/api-base/src/main/java/com/thoughtworks/go/api/ApiController.java"}},{"signature_version":"v1","source":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a","target":{"file":"api/api-notification-filter-v2/src/main/java/com/thoughtworks/go/apiv2/notificationfilter/NotificationFilterControllerV2.java","function":"setupRoutes"},"deprecated":false,"digest":{"length":1010,"function_hash":"12503590976553436403439966715832949443"},"id":"CVE-2026-52740-adc2caf6","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a","target":{"file":"api/api-notification-filter-v2/src/main/java/com/thoughtworks/go/apiv2/notificationfilter/NotificationFilterControllerV2.java"},"deprecated":false,"digest":{"line_hashes":["319346411546586734007045089626246746620","109478149295124471267336575711884617889","58104110657883947900887752589609710409","78391500584254355365909221986420623780","283033164189821165560514441721881624507","299195488403419679261745496219809601114","37026519620005925749984016347909500886","165050798654648845037530130398083668650","191722709695056456537753366093049998180","130857355554121021035477702816020087620","23898326370124412539858631761597155453","167758373124721428643788055193180871568"],"threshold":0.9},"id":"CVE-2026-52740-e233053c","signature_type":"Line"},{"source":"https://github.com/gocd/gocd/commit/614d694c6d9d8714517db8f9f1581cc1c140506a","target":{"file":"api/api-template-config-v7/src/main/java/com/thoughtworks/go/apiv7/admin/templateconfig/TemplateConfigControllerV7.java","function":"setupRoutes"},"deprecated":false,"digest":{"function_hash":"330904792761665314846494379543338778927","length":1429},"id":"CVE-2026-52740-eaf0efc3","signature_type":"Function","signature_version":"v1"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52740.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}