Skip to content
Heist/ feed
High

Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review

Type: advisorySource: Official CVE List1 source record

Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user (or an unauthenticated user if the repository was previously public) to cause unauthorized disclosure of private repository content and durable restoration of revoked project-owner administrative privileges via crafted requests using repeated .git suffixes (such as project.git.git) across REST APIs, Gitiles, or SSH Git commands. Because Gerrit strips only a single terminal .git suffix when constructing the logical ProjectCache key while JGit (FileKey.lenient) resolves the suffixed alias to the same canonical bare repository on disk, revoking read access or removing owner rules on the canonical project name fails to evict the cached alias ProjectState during the cache validity window, enabling reads of newly created private commits or writes to refs/meta/config. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.

Announced Source revision 1
Original source ↗

CVE-2026-87720

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-87720

Gerrit

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Gerrit",
    "product": "Gerrit",
    "versions": [
      {
        "status": "affected",
        "version": "2.16.0",
        "lessThan": "3.12.10",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "3.13.0",
        "lessThan": "3.13.9",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "3.14.0",
        "lessThan": "3.14.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-87720

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#2194 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement