Back to search
CVE-2026-2725
Published: May 13, 2026
Modified: May 13, 2026
PUBLISHED
Description
Incorrect authorization in the "submitted together" feature in Gerrit versions 2.12 and later allows an authenticated attacker with force push permissions on a secondary branch to bypass code review and forcefully submit code to restricted branches via a crafted submission matching the "topic" tag of an unapproved change.
| Vendor | Product | Versions |
|---|---|---|
Gerrit | Gerrit | affected 2.12; 0 |
Weaknesses (CWE)
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now