Medium severity5.3NVD Advisory· Published May 13, 2026· Updated Jun 30, 2026
CVE-2026-2725
CVE-2026-2725
Description
Incorrect authorization in the "submitted together" feature in Gerrit versions 2.12 and later allows an authenticated attacker with force push permissions on a secondary branch to bypass code review and forcefully submit code to restricted branches via a crafted submission matching the "topic" tag of an unapproved change.
Affected products
2Patches
Vulnerability mechanics
References
1- issues.gerritcodereview.com/issues/486131256nvdMailing ListPatchVendor Advisory
News mentions
0No linked articles in our index yet.