Gerrit up to 3.12.9/3.13.8/3.14.2 Project Name Normalization/ProjectCache Eviction ProjectUtil.stripGitSuffix/ProjectCacheImpl authorization

Summaryinfo

A vulnerability, which was classified as critical, has been found in Gerrit up to 3.12.9/3.13.8/3.14.2. This issue affects the function ProjectUtil.stripGitSuffix/ProjectCacheImpl of the component Project Name Normalization/ProjectCache Eviction. Performing a manipulation results in authorization. This vulnerability is cataloged as CVE-2026-87720. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Gerrit up to 3.12.9/3.13.8/3.14.2. This affects the function ProjectUtil.stripGitSuffix/ProjectCacheImpl of the component Project Name Normalization/ProjectCache Eviction. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user (or an unauthenticated user if the repository was previously public) to cause unauthorized disclosure of private repository content and durable restoration of revoked project-owner administrative privileges via crafted requests using repeated .git suffixes (such as project.git.git) across REST APIs, Gitiles, or SSH Git commands. Because Gerrit strips only a single terminal .git suffix when constructing the logical ProjectCache key while JGit (FileKey.lenient) resolves the suffixed alias to the same canonical bare repository on disk, revoking read access or removing owner rules on the canonical project name fails to evict the cached alias ProjectState during the cache validity window, enabling reads of newly created private commits or writes to refs/meta/config. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.

The advisory is shared at issues.gerritcodereview.com. This vulnerability is uniquely identified as CVE-2026-87720 since 09/09/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 3.12.10, 3.13.9 or 3.14.3 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Gerrit

Version

• 3.12.0
• 3.12.1
• 3.12.2
• 3.12.3
• 3.12.4
• 3.12.5
• 3.12.6
• 3.12.7
• 3.12.8
• 3.12.9
• 3.13.0
• 3.13.1
• 3.13.2
• 3.13.3
• 3.13.4
• 3.13.5
• 3.13.6
• 3.13.7
• 3.13.8
• 3.14.0
• 3.14.1
• 3.14.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion