Description
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames, and lock timestamps from private repositories.
Published: 2026-09-15
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 01:45:00 +0000

Type Values Removed Values Added
Description Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames, and lock timestamps from private repositories.
Title Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks
First Time appeared Charm
Charm soft Serve
Weaknesses CWE-639
CPEs cpe:2.3:a:charm:soft_serve:*:*:*:*:*:*:*:*
Vendors & Products Charm
Charm soft Serve
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Charm Soft Serve
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-15T01:20:34.488Z

Reserved: 2026-09-15T00:45:13.102Z

Link: CVE-2026-91773

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-15T02:16:50.013

Modified: 2026-09-15T02:16:50.013

Link: CVE-2026-91773

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key