CVE-2026-55632
Received Received - Intake

GoCD Pipeline Structure API User Enumeration Vulnerability

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode to regular authenticated users without requiring an administrator role. A lower-privileged user can enumerate configured user names and available role names, which can facilitate attacks against those users. The response does not reveal which roles are assigned to each user, and the endpoint cannot modify data. This issue is fixed in version 26.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-55632
EUVD
EUVD-2026-85517

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
thoughtworks gocd From 20.2.0 (inc) to 26.1.0 (inc)
thoughtworks gocd From 20.2.0 (inc) to 25.4.0 (inc)
thoughtworks gocd 26.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in GoCD versions 20.2.0 to 26.1.0 allows regular authenticated users to access user and role information via the internal pipeline structure API without admin privileges. The API exposes configured usernames and available roles but does not reveal role assignments or permit data modification. It is patched in version 26.1.0.

Detection Guidance

This vulnerability can be detected by checking GoCD versions prior to 26.1.0 and monitoring API responses for unauthorized user and role enumeration. Review logs for access to the pipeline structure API endpoint, particularly `/go/api/internal/pipeline_structure` or similar paths. Ensure no regular users can retrieve full user or role lists.

Impact Analysis

A lower-privileged user could enumerate other users and roles on the system, which may facilitate social engineering or targeted attacks against those users. The exposure is limited to information gathering and does not allow privilege escalation or data modification.

Mitigation Strategies

Upgrade GoCD to version 26.1.0 or later immediately. If upgrading is not possible, restrict access to the pipeline structure API endpoint via reverse proxy rules or network controls. Review and remove unnecessary user permissions to minimize exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55632. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart