CVE-2026-91773

EUVD-2026-78249
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames, and lock timestamps from private repositories.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/charmbracelet/soft-serve
https://github.com/charmbracelet/soft-serve/blob/v0.11.6/pkg/store/database/lfs.go#L115-L124
https://github.com/charmbracelet/soft-serve/commit/e34914699128c937afad167d43ccb5310e48b319
https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-xqg9-4q65-m2wf
https://www.vulncheck.com/advisories/soft-serve-0.7.1-through-0.11.6-information-disclosure-via-lfs-locks