Vulnerability Description
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames, and lock timestamps from private repositories.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/charmbracelet/soft-serve
- https://github.com/charmbracelet/soft-serve/blob/v0.11.6/pkg/store/database/lfs.
- https://github.com/charmbracelet/soft-serve/commit/e34914699128c937afad167d43ccb
- https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-xqg9-4q65-m
- https://www.vulncheck.com/advisories/soft-serve-0.7.1-through-0.11.6-information
FAQ
What is CVE-2026-91773?
CVE-2026-91773 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write...
How severe is CVE-2026-91773?
CVE-2026-91773 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-91773?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.