CVE-2026-2725Improper Authorization in Gerrit allowing Code Review Bypass via "Submitted Together"

Beschreibung

Incorrect authorization in the "submitted together" feature in Gerrit versions 2.12 and later allows an authenticated attacker with force push permissions on a secondary branch to bypass code review and forcefully submit code to restricted branches via a crafted submission matching the "topic" tag of an unapproved change.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• https://issues.gerritcodereview.com/issues/486131256 Mailing ListPatchVendor Advisory