The vulnerability in Soft Serve enables any authenticated SSH user to execute a repository import that clones a server‑local Git repository into a new repository they create. Because the import process does not enforce ownership checks, a user can clone another user's private repository, resulting in a confidentiality breach. This flaw corresponds to the confidentiality weakness (CWE-200) and the unauthorized credential validation weakness (CWE-862).

Charmbracelet’s Soft Serve, a self‑hostable Git server, is affected from version 0.6.0 up to but not including 0.11.6. The issue was fixed in release 0.11.6; users of any version before that are at risk.

The CVSS base score of 7.1 classifies the vulnerability as high severity. The EPSS value is reported as less than 1%, indicating that, at the time of this analysis, exploitation is unlikely to be widespread, and it is not listed in the CISA KEV catalog. Exposing private repositories can be achieved simply by a user who has SSH credentials and invokes the import command. Based on the description, the attack vector is the import feature; the risk is enhanced in environments where many users possess SSH access, and the potential confidentiality impact follows from the clone operation.