CVE-2026-91773— Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks
Quick assessment
Affected
charmbracelet soft-serve
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Soft Serve 0.7.1 至 0.11.6 版本未将 Git LFS 锁查询限定在特定仓库范围内，导致经过身份验证的用户能够读取其无权访问的仓库中的锁元数据。拥有任意一个仓库写权限的攻击者可以在全局范围内枚举锁 ID，从而获取私有仓库中被锁定文件的路径、用户名以及锁定时间戳。
Possible ATT&CK Techniques 1 AI
T1210 · Exploitation of Remote Services
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-91773
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks
Source: CVE Program / CVE List V5
Vulnerability Description
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames, and lock timestamps from private repositories.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| charmbracelet | soft-serve | 0.7.1 ~ 0.12.0 | - |
|
II. Public POCs for CVE-2026-91773
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-91773
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-91773 (2)
Vendor Advisories for CVE-2026-91773 (2)
IV. Related Vulnerabilities
Same product: soft-serve
-
CVE-2026-33353
Soft Serve: Authenticated repo import can clone server-local -
CVE-2026-30832
Soft Serve: SSRF via unvalidated LFS endpoint in repo import -
CVE-2026-24058
Soft Serve has Critical Authentication Bypass -
CVE-2026-22253
Soft Serve is missing an authorization check in LFS lock del -
CVE-2025-64522
Soft Serve is vulnerable to SSRF through its Webhooks
Same vendor: charmbracelet
-
CVE-2026-41589
Wish has SCP Path Traversal that allows arbitrary file read/ -
CVE-2026-33353
Soft Serve: Authenticated repo import can clone server-local -
CVE-2026-30832
Soft Serve: SSRF via unvalidated LFS endpoint in repo import -
CVE-2026-24058
Soft Serve has Critical Authentication Bypass -
CVE-2026-22253
Soft Serve is missing an authorization check in LFS lock del
Same weakness: CWE-639
-
CVE-2026-90858
subhajitkhan online-clinic-management-system adminappview.ph -
CVE-2026-91770
IceHRM before 36.0.0 Broken Access Control via Employee ID -
CVE-2026-91144
ZFile through 5.0.5 Share Entry Filter Bypass via Download E -
CVE-2026-54180
backpack/crud: CRUD panel query scopes are not enforced on U -
CVE-2026-9812
Missing property field ownership validation in Playbooks run
V. Comments for CVE-2026-91773
No comments yet