The vulnerability arises because the /go/api/support/process_list endpoint in GoCD does not enforce the intended administrator‑only authorization. An authenticated user, even with a non‑admin role, can query the endpoint while source control child processes are running. The response reveals command‑line arguments, usernames, remote material URLs, and internal material paths for materials that the user normally cannot access. Although the endpoint does not leak credentials, environment variables, or user‑defined secrets, the exposed information could aid a malicious actor in mapping the internal structure, identifying vulnerable components, and planning further attacks. The weakness is a classic authorization bypass (CWE‑863) that results in non‑confidentiality impact.

Affected systems are all GoCD installations from version 13.1.0 up to, but not including, 26.1.0. The issue was identified in the product’s release notes and fixed in GoCD 26.1.0. Any deployment using any of those versions may be impacted.

The risk is low to moderate, reflected in a CVSS base score of 3.7. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated internal user and unpredictable process timing; the attack surface is thus limited to legitimate users with knowledge of when repository material processes are active.