CVE-2026-91773CWE-639

CVE-2026-91773

Medium · published September 15, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
26.5
In the wild
Unconfirmed
What it is

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames, and lock timestamps from private repositories.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00342 · 26.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-15T06:16Z
References (5)
https://github.com/charmbracelet/soft-serve · [email protected]https://github.com/charmbracelet/soft-serve/blob/v0.11.6/pkg/store/database/lfs.go#L115-L124 · [email protected]https://github.com/charmbracelet/soft-serve/commit/e34914699128c937afad167d43ccb5310e48b319 · [email protected]https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-xqg9-4q65-m2wf · [email protected]https://www.vulncheck.com/advisories/soft-serve-0.7.1-through-0.11.6-information-disclosure-via-lfs-locks · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 15 SEP 01:20Z
    Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks
    cvelistv5