CVE-2026-2725

Katalog CVE

CVSS 5.3 · Medium EPSS 0,16%

Kerentanan Incorrect Authorization pada google gerrit. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Incorrect authorization in the "submitted together" feature in Gerrit versions 2.12 and later allows an authenticated attacker with force push permissions on a secondary branch to bypass code review and forcefully submit code to restricted branches via a crafted submission matching the "topic" tag of an unapproved change.

Rincian

Terbit di NVD

13 Mei 2026

Terakhir diubah

30 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 5,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://issues.gerritcodereview.com/issues/486131256 mailing list · patch · advisory vendor