The GoCD continuous delivery server exposes a job status API endpoint, /jobStatus.json, that does not confirm that the job ID requested belongs to the pipeline and stage specified. As a result, any authenticated user can enumerate job IDs and retrieve status details for jobs in pipelines that they are not authorized to view. The response reveals job names, state, progress timestamps, agent IP addresses, UUIDs, and references to associated stages and pipelines. While console output, artifacts and configuration data are not exposed, the disclosed metadata still constitutes an information disclosure via an authorization bypass.

The flaw affects all installations of GoCD earlier than version 26.1.0. Any deployment of GoCD that has not been upgraded to 26.1.0 or later is potentially vulnerable. This includes both on‑premises and cloud‑based instances that are still running a pre‑26.1.0 release.

With a CVSS score of 4.3, the vulnerability is evaluated as moderate severity. No EPSS score is reported, and the vulnerability is not listed in CISA's KEV catalog, suggesting that it has not yet been observed in the wild or is not actively exploited. However, the vulnerability is trivial for an authenticated user because it merely requires guessing job identifiers; enumeration can be automated. As a result, the potential for widespread information leakage is present if an internal attacker or a rogue user gains access to user credentials. Organizations with relaxed pipeline permissions or who allow broad authenticated access to job status are especially at risk.