A flaw in Soft Serve’s LFS lock deletion endpoint permits any authenticated user with write access to a repository to delete locks belonging to other users by supplying the force flag. The code processes force deletions before verifying the user context, so ownership checks are bypassed entirely, enabling unauthorized removal of LFS locks without any additional privileges beyond repository write access.

The vulnerability impacts the Soft Serve project maintained by charmbracelet. Versions prior to 0.11.2 are affected; the issue has been resolved in version 0.11.2 and later.

The CVSS score is 5.4, indicating moderate severity. The EPSS score is below 1%, suggesting a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the instance and possess repository write permissions, then request a force deletion of a lock. If those conditions are met, the attacker can delete any LFS lock owned by another user without any additional checks.