EUVD-2026-29910
GHSA-h457-956r-2pr8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires force push on a secondary branch (PR:L) and a matching topic tag on an existing unapproved change (AC:H); impact is integrity-only with no scope change.
Primary rating from Vendor (Google).
CVSS VectorVendor: Google
Lifecycle Timeline
2DescriptionCVE.org
Incorrect authorization in the "submitted together" feature in Gerrit versions 2.12 and later allows an authenticated attacker with force push permissions on a secondary branch to bypass code review and forcefully submit code to restricted branches via a crafted submission matching the "topic" tag of an unapproved change.
AnalysisAI
Incorrect authorization in Gerrit's 'submitted together' feature (versions 2.12 and later) allows an authenticated attacker holding force push permissions on a secondary branch to bypass mandatory code review and inject unapproved commits into restricted branches. By crafting a submission whose 'topic' tag matches that of an existing unapproved change targeting a protected branch, the attacker exploits the grouped-submission mechanism to smuggle unauthorized code past governance controls. A proof-of-concept is acknowledged in the SSVC assessment; however, EPSS sits at 0.03% (9th percentile) and exploitation is flagged as non-automatable, indicating targeted rather than widespread opportunistic abuse.
Technical ContextAI
Gerrit is a Git-based code review and repository management platform originally developed by Google, widely deployed in enterprise CI/CD pipelines. Its 'submitted together' feature allows developers to atomically submit a set of related changes grouped under a shared 'topic' tag - a convenience mechanism for landing interdependent commits across branches simultaneously. The affected CPE (cpe:2.3:a:gerrit:gerrit:*:*:*:*:*:*:*:*) covers all Gerrit instances from version 2.12 onward with no confirmed upper bound. CWE-863 (Incorrect Authorization) identifies the root cause: the authorization logic governing topic-grouped submissions fails to verify that every change in the submitted-together batch has individually satisfied the required review and approval workflow before permitting submission to a protected branch, creating a permission boundary bypass between branches with different access controls.
RemediationAI
The upstream fix is documented in the Gerrit issue tracker at https://issues.gerritcodereview.com/issues/486131256 - administrators should consult this directly for the confirmed patched release version and upgrade accordingly, as no exact fix version was confirmed in the available data. As a compensating control pending upgrade, audit and minimize force push permissions on all secondary branches, as this specific permission is a non-negotiable prerequisite for exploitation; removing it from non-essential accounts eliminates the attack path without affecting normal review workflows. Alternatively, disabling or restricting the 'submitted together' / topic-based grouped submission feature on repositories with sensitive protected branches removes the attack surface entirely, though this will break atomic cross-branch submission workflows for teams relying on that feature. Neither workaround should be treated as a permanent substitute for patching.
Any git operation is passed through Jetty and a session is created. Rated high severity (CVSS 7.5), this vulnerability i
An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 wh
An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a mis
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today