CVE-2026-91773

Medium

Description

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames, and lock timestamps from private repositories.

SeverityMedium

CVSS4.3

Exploit probability—

ProductCharmbracelet Soft-serve

PublishedSep 15, 2026

First seenSep 15, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Update

charmbracelet soft-serve0.12.0 or later

Patches

github.com/charmbracelet/soft-serve/commit/e34914699128c937afad167d43ccb5310e48b319

Vendor advisories

github.com/charmbracelet/soft-serve/security/advisories/GHSA-xqg9-4q65-m2wf

Affected products

Product	Affected versions	Fixed in
charmbracelet soft-serve	0.7.1 ≤ v < 0.12.0	0.12.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.