CVE-2020-8920: Google Gerrit

Low severity, CVSS 3.5. EPSS: 0.4% chance of exploitation in the next 30 days.

An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users' personal information associated with their accounts.

Affected products

• Google Gerrit: from 2.14.0, before 2.14.22 (fixed in 2.14.22); from 2.15.0, before 2.15.21 (fixed in 2.15.21); from 2.16.0, before 2.16.25 (fixed in 2.16.25); from 3.0.0, before 3.0.15 (fixed in 3.0.15); from 3.1.0, before 3.1.10 (fixed in 3.1.10); from 3.2.0, before 3.2.5 (fixed in 3.2.5)

Published 2020-12-10. Last modified 2026-06-17.