Auth bypass in Charmbracelet Soft-Serve
CVE-2026-91773
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames, and lock timestamps from private repositories.
Vulnerability class: IDOR (Insecure Direct Object Reference)
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (technical-description)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-91773?
- CVE-2026-91773 is a medium-severity vulnerability in Charmbracelet Soft-Serve, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.3/10. Published 2026-09-15.
- How severe is CVE-2026-91773?
- Medium severity. CVSS v3 base score is 4.3 out of 10.