A vulnerability in GoCD, a continuous delivery server, allows users with write access to a material to store arbitrary HTML or JavaScript in a forged package material comment. This comment can execute in the browser session of a user who later views an affected page, potentially exposing a privileged user session or allowing changes using the victim's credentials and privileges. The issue is fixed in version 26.1.0.
CVE-2026-52743 debrief based on the supplied source corpus. The CVE record was published on 2026-09-21T15:17:28.950Z and has not been modified since then. GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and [truncated]
