The vulnerability arises from a case‑sensitive comparison of HTTP method names in the Get Template Config API. An authenticated user with lower privileges can craft a request using a nonstandard capitalization of the method (e.g., “get” instead of “GET”) to bypass the view permission check. This allows the attacker to retrieve pipeline templates by name and read their configuration, potentially exposing sensitive information. The impact is unauthorized read access to pipeline configuration data. The flaw does not affect data‑modifying API operations, variable encryption, or deployments that reject non‑uppercase HTTP methods via a reverse proxy.

The issue affects GoCD server versions starting from 18.7.0 up to, but not including, 26.1.0. The affected vendor is GoCD. Upgrading to version 26.1.0 or later resolves the issue.

The CVSS score is 5.3, indicating medium severity. EPSS is not available, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The attack requires only an authenticated user with limited privileges and the ability to send a custom HTTP method. Because the exploit path is straightforward and does not rely on privileged escalation or complex conditions, the risk remains moderate for environments that have not applied the patch.