CVE-2026-2725
MEDIUM WAF: Low
CVSS 5.3
Published: 2026-05-13
CWE-863
Incorrect authorization in the "submitted together" feature in Gerrit versions 2.12 and later allows an authenticated attacker with force push permissions on a secondary branch to bypass code review and forcefully submit code to restricted branches via a crafted submission matching the "topic" tag of an unapproved change.
WAF Coverage Analysis
Incorrect Authorization
Low WAF Coverage
OWASP: A01:2021 Broken Access Control
Affected Software
| Vendor | Product | Version |
|---|---|---|
| gerrit | all versions |
References
- issues.gerritcodereview.com (Mailing List, Patch, Vendor Advisory)