Security readout for executives and security teams
Plain-English summary
CVE-2026-2725 is an authorization flaw in Gerrit code review. An authenticated user with force-push rights on a secondary branch could bypass review controls and submit code to restricted branches through the “submitted together” feature. This affects source-code integrity rather than availability or confidentiality.
Executive priority
Treat as a medium-priority source-code integrity risk. Prioritize environments hosting critical code or broad developer permissions. Immediate focus should be permission review and vendor guidance tracking.
Technical view
Gerrit 2.12 and later are described as affected. The flaw is CWE-863 improper authorization in “submitted together,” involving crafted submission behavior tied to a matching topic tag. CVSS v4.0 is 6.0, with low attack complexity, low privileges required, and high integrity impact.
Likely exposure
Organizations running Gerrit 2.12 or later are potentially exposed, especially where users have force-push permissions on secondary branches and workflows use topics or submitted-together changes.
Exploitation context
Sources do not report active exploitation, and the CVE is not marked KEV. Abuse requires authenticated access and specific repository permissions, limiting broad internet-scale exposure but increasing insider or compromised-account risk.
Researcher notes
Public detail is limited to the CVE description and Gerrit issue reference. No patch version or exploit evidence is provided in the supplied sources. Avoid assuming impact beyond Gerrit’s authorization and code-review bypass scenario.
Mitigation direction
- Check Gerrit vendor guidance and issue 486131256 for fixed versions or official workarounds.
- Review and minimize force-push permissions, especially on secondary branches.
- Audit topic-based and submitted-together workflows for restricted branch protections.
- Monitor recent restricted-branch submissions for unexpected topic-linked changes.
Validation and detection
- Inventory Gerrit instances and confirm version exposure against vendor guidance.
- Review project permissions for users or groups with force-push rights.
- Check whether submitted-together and topic workflows are used on protected repositories.
- Audit recent merged changes to restricted branches for unusual topic relationships.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-2725 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N——GoogleVulnerability scoring details
Base CVSS 4.0 score
6MediumVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://issues.gerritcodereview.com/issues/486131256CVE reference, Google
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.