CVE-2026-91773
Received Received - Intake

Git LFS Lock Metadata Exposure in Soft Serve

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames, and lock timestamps from private repositories.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91773
EUVD
EUVD-2026-78249

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
soft_serve soft_serve From 0.7.1 (inc) to 0.11.6 (inc)
charmbracelet soft_serve From 0.7.1 (inc) to 0.11.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Soft Serve versions 0.7.1 through 0.11.6 have a flaw in Git LFS lock handling where authenticated users with write access to any repository can bypass authorization. The system fails to scope Git LFS lock queries by repository, allowing attackers to enumerate lock IDs globally and retrieve sensitive metadata like locked file paths, usernames, and timestamps from private repositories they cannot access.

Detection Guidance

To detect this vulnerability, check if your Soft Serve instance is running a vulnerable version (0.7.1 through 0.11.6). Inspect Git LFS lock endpoints for unauthorized access to lock metadata. Review logs for unusual enumeration of lock IDs across repositories. Use commands like 'curl' to query LFS lock endpoints and verify if private repository data is exposed.

Impact Analysis

If you use Soft Serve with Git LFS enabled, an attacker with write access to any repository could access confidential information in private repositories. This includes file paths of locked files, usernames of users holding locks, and timestamps. The impact is limited to information disclosure and does not affect system integrity or availability.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations handling regulated data must address this flaw to maintain compliance, as unauthorized disclosure of personal or health information may result in legal and regulatory penalties.

Mitigation Strategies

Upgrade Soft Serve to version 0.12.0 or later to patch the vulnerability. Alternatively, disable Git LFS HTTP interfaces if upgrading is not immediately possible. Ensure proper scoping of Git LFS lock queries by repository to prevent unauthorized access to lock metadata.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91773. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart