CVE-2026-33353CWE-200CWE-862

Soft Serve: Authenticated repo import can clone server-local private repositories

High · published March 24, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
36.3
In the wild
Unconfirmed
What it is

Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.6, an authorization flaw in repo import allows any authenticated SSH user to clone a server-local Git repository, including another user's private repo, into a new repository they control. This issue has been patched in version 0.11.6.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00431 · 36.3th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-862 · Missing Authorization
Published
2026-03-24T19:39Z
EPSS history
Timeline
  • 24 MAR 19:39Z
    Soft Serve: Authenticated repo import can clone server-local private repositories
    cvelistv5