Gerrit Code Review EUVD-2026-86476

Requires an authenticated Gerrit account that previously held access to (or ownership of) a project whose read access was later revoked or whose owner rules were removed - the flaw lets that stale access persist. The unauthenticated path applies only if the target repository was previously public. The attacker must send requests referencing the project with repeated terminal '.git' suffixes (e.g., project.git.git) across REST APIs, Gitiles, or SSH Git commands. Exploitation is bounded by the ProjectCache validity window: the stale alias ProjectState is only served until it would normally be evicted, so the attacker must act before natural cache expiry. Affects default configurations of Gerrit 2.16.0-3.12.9, 3.13.0-3.13.8, and 3.14.0-3.14.2; no special non-default feature toggle is required.

This is a credible, high-value authorization flaw (CWE-863) in Gerrit Code Review, reported by Google and confirmed via the official Gerrit issue tracker (issues.gerritcodereview.com/issues/538883789) with vendor-confirmed fixes (3.12.10, 3.13.9, 3.14.3). The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N = 7.6) indicates a network-reachable, low-complexity attack requiring only a low-privileged authenticated account, with a defined attack requirement (AT:P) that maps to the ProjectCache validity window / timing dependency described in the text. Dual impact is significant: high confidentiality (disclosure of private repository content) AND high integrity (durable restoration of revoked project-owner administrative privileges plus writes to refs/meta/config). Countervailing signals lower urgency: no EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data - no public exploit identified at time of analysis. The description also introduces an unauthenticated path ('or an unauthenticated user if the repository was previously public') that is narrower than the base PR:L vector and is condition-gated, so the CVSS PR:L reflects the general authenticated case rather than the edge case. Net: a real priority for organizations running affected Gerrit versions that host private repositories and rely on access revocation, but not evidence of widespread active exploitation - treat as a patch-soon rather than emergency-if-not-exposed decision, weighted up for internet-facing Gerrit instances.

A low-privileged authenticated Gerrit user who previously had access to a project that was later made private (or had owner rules revoked) issues crafted REST API, Gitiles, or SSH Git requests referencing the project with a doubled suffix such as 'project.git.git'. Because Gerrit strips only one terminal '.git' when building the ProjectCache key while JGit's FileKey.lenient resolves the alias to the same canonical bare repo, the stale cached ProjectState is served - letting the attacker read newly created private commits or write to refs/meta/config to restore owner privileges. No public exploit code is identified in the provided data, but the technique is fully described and low-complexity.