CVE-2026-2725 Overview
CVE-2026-2725 is an authorization bypass vulnerability in Gerrit Code Review versions 2.12 and later. The flaw resides in the "submitted together" feature, which groups related changes for atomic submission based on shared topic tags. An authenticated attacker with force push permissions on a secondary branch can bypass code review controls. The attacker submits a crafted change matching the topic tag of an unapproved change on a restricted branch. Gerrit incorrectly authorizes the operation and forcefully merges the unapproved code into the protected branch. The vulnerability is tracked as CWE-863: Incorrect Authorization.
Critical Impact
Authenticated users with limited write access to non-protected branches can push unreviewed code into restricted branches, undermining code review integrity.
Affected Products
- Gerrit Code Review version 2.12
- Gerrit Code Review versions later than 2.12
- Repositories using the "submitted together" topic-based submission feature
Discovery Timeline
- 2026-05-13 - CVE-2026-2725 published to the National Vulnerability Database (NVD)
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-2725
Vulnerability Analysis
Gerrit's "submitted together" feature collects changes that share a common topic tag and submits them as an atomic unit. The authorization logic evaluates push permissions on the branch where the submitting user has direct access. It fails to independently validate code review approval and submission permissions for every branch touched by the grouped changes.
An attacker leverages this inconsistency by creating a change on a secondary branch where they hold force push rights. The attacker assigns this change the same topic tag as a pending, unapproved change on a restricted branch. When the attacker submits their own change, Gerrit treats the grouped set as authorized and merges the unapproved change into the restricted branch. The result is code reaching protected branches without passing required review gates.
Root Cause
The root cause is incomplete permission enforcement across grouped submissions. Gerrit validates authorization at the entry point of the submission action rather than enforcing per-branch policy on each change in the group. Because the "submitted together" feature inherits trust from the initiating user's context, it overrides branch-level review requirements on linked changes.
Attack Vector
Exploitation requires network access to the Gerrit instance and an authenticated account with force push permission on at least one branch. The attacker creates an unapproved change targeting a restricted branch, or locates an existing pending change. They then create a second change on a branch they control, tagging it with the matching topic value. Submitting the attacker-controlled change triggers atomic submission of both changes, merging unreviewed code into the protected branch.
No verified public exploit code is available. See the Gerrit Code Review Issue 486131256 for upstream technical details.
Detection Methods for CVE-2026-2725
Indicators of Compromise
- Merge commits on restricted branches lacking the expected Code-Review+2 or Verified+1 labels in Gerrit audit logs.
- Submission events where the submitter lacks direct submit permissions on the target branch, but holds force push on a related branch.
- Clusters of changes sharing identical topic values that span branches with differing protection levels.
Detection Strategies
- Audit Gerrit submission events through RefUpdatedEvent and ChangeMergedEvent records to identify cross-branch submissions linked by topic tags.
- Compare commit author and submitter identities against branch-level access control lists to flag mismatches.
- Review Git reflog history on restricted branches for merges that bypassed expected review states.
Monitoring Recommendations
- Forward Gerrit event-stream logs to a centralized SIEM and alert on submissions touching restricted branches without recorded approval labels.
- Monitor for newly created changes that adopt topic values matching pending changes on protected branches.
- Track force push activity on secondary branches and correlate with subsequent submissions involving the same topic.
How to Mitigate CVE-2026-2725
Immediate Actions Required
- Identify all Gerrit instances running version 2.12 or later and inventory branches that rely on the "submitted together" feature.
- Restrict force push permissions to a minimal set of trusted accounts on every branch within affected projects.
- Review recent merges on restricted branches for unauthorized changes introduced through topic-grouped submissions.
Patch Information
The Gerrit project tracks remediation in Gerrit Code Review Issue 486131256. Apply the upstream fix once available and upgrade to a patched Gerrit release. No fixed version is listed in the NVD record at publication.
Workarounds
- Disable or limit use of the "submitted together" topic-based submission feature in projects with restricted branches.
- Remove force push permissions from all accounts that do not require them, including service accounts.
- Enforce branch-level submit requirements that mandate explicit review approval before any change merges, regardless of topic grouping.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
