CVE-2026-87720 Gerrit CVE debrief

Who should care

Gerrit Code Review administrators and users should assess exposure and apply patches to prevent unauthorized access to private repositories and restoration of revoked administrative privileges.

Why it matters

CVE-2026-87720 is a high-severity vulnerability in Gerrit Code Review that allows an authenticated user to cause unauthorized disclosure of private repository content and restoration of revoked project-owner administrative privileges. Gerrit Code Review administrators and users should assess exposure and apply patches to prevent unauthorized access.

• Potential unauthorized disclosure of private repository content
• Potential restoration of revoked project-owner administrative privileges
• Need to verify and apply patches to Gerrit Code Review instances
• Need to review and update access controls for private repositories

Technical summary

The vulnerability is caused by incorrect authorization in Gerrit Code Review, specifically in the ProjectUtil.stripGitSuffix and ProjectCacheImpl classes. This allows an authenticated user to cause unauthorized disclosure of private repository content and restoration of revoked project-owner administrative privileges via crafted requests using repeated .git suffixes. The issue arises from Gerrit stripping only a single terminal .git suffix when constructing the logical ProjectCache key, while JGit resolves the suffixed alias to the same canonical bare repository on disk. This discrepancy enables reads of newly created private commits or writes to refs/meta/config.

Defensive priority

High priority for Gerrit Code Review administrators and users to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure and apply patches to Gerrit Code Review instances
• Review and update access controls for private repositories
• Monitor for suspicious activity on Gerrit Code Review instances
• Verify patch application and test for vulnerability remediation
• Review system logs for signs of exploitation attempts
• Update incident response plans to include potential CVE-2026-87720 exploitation
• Perform a thorough review of Gerrit Code Review instance configurations

Evidence notes

The vulnerability allows an authenticated user to cause unauthorized disclosure of private repository content and durable restoration of revoked project-owner administrative privileges via crafted requests using repeated .git suffixes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.