Auth bypass in Charmbracelet Soft-Serve
CVE-2026-91773
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames, and lock timestamps from private repositories.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (27.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 27.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
Weakness classification (CWE)
References
- GitHub Security Advisory (GHSA-xqg9-4q65-m2wf) (vendor-advisory)
- github.com/charmbracelet/soft-serve/commit/e34914699128c937afad167d43ccb5310e48… (patch)
- github.com/charmbracelet/soft-serve/blob/v0.11.6/pkg/store/database/lfs.go (technical-description)
- github.com/charmbracelet/soft-serve (product)
- VulnCheck Advisory: Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks (third-party-advisory)
Frequently asked questions
- What is CVE-2026-91773?
- CVE-2026-91773 is a medium-severity vulnerability in Charmbracelet Soft-Serve, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.3/10. Published 2026-09-15.
- How severe is CVE-2026-91773?
- Medium severity. CVSS v3 base score is 4.3 out of 10.