Product:
Gerrit
Summary
Incorrect authorization in the submitted together feature in Gerrit allows an authenticated attacker with force push permissions on a secondary branch to bypass code review. This enables the attacker to forcefully submit code to restricted branches via a crafted submission matching the topic tag of an unapproved change.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6 | CVE-2026-2725 |
Exploitation
To exploit this vulnerability, an attacker must have authenticated access and force push permissions on a secondary branch. By crafting a submission that matches the topic tag of an unapproved change, the attacker can bypass the code review process and submit code directly to restricted branches, potentially compromising the integrity of the codebase.
Affected Products
- Gerrit versions 2.12 and later: Vulnerable due to incorrect authorization in the submitted together feature.
Mitigation
To mitigate this vulnerability, it is recommended to review and restrict force push permissions for authenticated users. Additionally, updating to the latest version of Gerrit that addresses this issue will help prevent unauthorized code submissions.