CVE-2026-2725mediumCWE-863

CVE-2026-2725: falha de média gravidade em Gerrit

Improper Authorization in Gerrit allowing Code Review Bypass via "Submitted Together"

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Gerrit

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6epss 0.1%
Incorrect authorization in the "submitted together" feature in Gerrit versions 2.12 and later allows an authenticated attacker with force push permissions on a secondary branch to bypass code review and forcefully submit code to restricted branches via a crafted submission matching the "topic" tag of an unapproved change.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Gerrit · Gerrit
CVEs relacionadas — Gerrit

No mesmo produto, das mais perigosas para as menos.

CVE-2020-8920LOWOveroptimization leads to private information leak in GerritEPSS 0.4%CVE-2026-87722HIGHRegular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code ReviewEPSS 0.3%CVE-2026-87721HIGHDenial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code ReviewEPSS 0.3%CVE-2020-8919LOWInformation leakage in GerritEPSS 0.3%CVE-2026-87720HIGHIncorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code ReviewEPSS 0.3%