The flaw lies in Gerrit Code Review’s handling of project name normalization and its cache eviction logic. When a project name is passed through the stripGitSuffix routine, only a single trailing .git suffix is removed, while the underlying cache key remains tied to the first occurrence of the name. An attacker can craft a request with a repeatedly suffixed name such as project.git.git, drive the system to use a cached alias, and gain read access to private repository content or re‑establish administrative privileges that had been revoked. This unauthorized disclosure and privilege restoration is enabled by the mismatch between Gerrit’s key construction and JGit’s handling of repository aliases.

The vulnerability affects Gerrit Code Review deployments running versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2. The issue is specific to the Gerrit product and the project cache subsystem; any installation within these version ranges that exposes REST APIs, Gitiles, or SSH Git access is potentially impacted.

With a CVSS score of 7.6 the flaw is considered high risk. The EPSS score is not available, and it is not listed in CISA’s KEV catalog. The likely attack vector involves an authenticated user or one who can connect to a previously public repository, making multiple requests that include repeated .git suffixes against REST endpoints, Gitiles listings, or SSH Git commands. Because the cache validity window permits the stale key to remain in use, an attacker can read or modify data that should remain restricted until the patch is applied.