Read the docs
TI-2026-59881 Aliases CVE-2026-87720GHSA-c8r3-7jgc-cm9w

Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review

Priority HIGH 68CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user (or an unauthenticated user if the repository was previously public) to cause unauthorized disclosure of private repository content and durable restoration of revoked project-owner administrative privileges via crafted requests using repeated .git suffixes (such as project.git.git) across REST APIs, Gitiles, or SSH Git commands. Because Gerrit strips only a single terminal .git suffix when constructing the logical ProjectCache key while JGit (FileKey.lenient) resolves the suffixed alias to the same canonical bare repository on disk, revoking read access or removing owner rules on the canonical project name fails to evict the cached alias ProjectState during the cache validity window, enabling reads of newly created private commits or writes to refs/meta/config. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00305 23rd percentileScored 2026-11-07
Fix Fixed Gerrit (Gerrit): 3.12.10, 3.13.9, 3.14.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleGerrit2.16.0 to before 3.12.10; 3.13.0 to before 3.13.9; 3.14.0 to before 3.14.33.12.10, 3.13.9, 3.14.3Patch availableCNA
  • Gerrit VendorGoogle Affected 2.16.0 to before 3.12.10; 3.13.0 to before 3.13.9; 3.14.0 to before 3.14.3 Fixed in 3.12.10, 3.13.9, 3.14.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:google:gerrit:*:*:*:*:*:*:*:*——Google
  • cpe:2.3:a:google:gerrit:*:*:*:*:*:*:*:* Versions — — ·Google

Remediation

  • Fix · CNA Gerrit (Gerrit) Fixed in 3.12.10, 3.13.9, 3.14.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Gerrit 3.12.10, 3.13.9, 3.14.3

    3 records Highest priority Priority HIGH 3 HIGH

    Other records, highest priority first

    • TI-2026-59883 Regular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code ReviewPriority HIGH 77
    • TI-2026-59882 Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code ReviewPriority HIGH 77
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-87720
  2. 2026-10-03 Alias added: GHSA-c8r3-7jgc-cm9w

References

Other 1

  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
See all 17247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences