Medium severity4.3NVD Advisory· Published Sep 15, 2026
CVE-2026-91773
CVE-2026-91773
Description
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames, and lock timestamps from private repositories.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: 0.7.1 - 0.11.6
Patches
Vulnerability mechanics
References
4- github.com/charmbracelet/soft-serve/blob/v0.11.6/pkg/store/database/lfs.gonvd
- github.com/charmbracelet/soft-serve/commit/e34914699128c937afad167d43ccb5310e48b319nvd
- github.com/charmbracelet/soft-serve/security/advisories/GHSA-xqg9-4q65-m2wfnvd
- www.vulncheck.com/advisories/soft-serve-0.7.1-through-0.11.6-information-disclosure-via-lfs-locksnvd
News mentions
0No linked articles in our index yet.