Read the docs
TI-2026-17863 Aliases CVE-2026-22253GHSA-6jm8-x3g6-r33j

Soft Serve is missing an authorization check in LFS lock deletion

Priority MEDIUM 58CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypass in the LFS lock deletion endpoint allows any authenticated user with repository write access to delete locks owned by other users by setting the force flag. The vulnerable code path processes force deletions before retrieving user context, bypassing ownership validation entirely. This issue has been patched in version 0.11.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00303 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed soft-serve (charmbracelet): 0.11.2github.com/charmbracelet/soft-serve (Go): 0.11.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
charmbraceletsoft-servebefore 0.11.20.11.2Patch availableCNA
—github.com/charmbracelet/soft-serve (Go)before 0.11.20.11.2Patch availableGHSA-6jm8-x3g6-r33j
  • soft-serve Vendorcharmbracelet Affected before 0.11.2 Fixed in 0.11.2 Patch available CNA
  • github.com/charmbracelet/soft-serve (Go) Vendor— Affected before 0.11.2 Fixed in 0.11.2 Patch available GHSA-6jm8-x3g6-r33j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:charm:soft_serve:*:*:*:*:*:go:*:*before 0.11.2Vulnerablecharmbracelet
  • cpe:2.3:a:charm:soft_serve:*:*:*:*:*:go:*:* Versions before 0.11.2 Vulnerable ·charmbracelet

Remediation

  • Fix · CNA soft-serve (charmbracelet) Fixed in 0.11.2
  • Fix · GHSA-6jm8-x3g6-r33j github.com/charmbracelet/soft-serve (Go) Fixed in 0.11.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22253
  2. 2026-10-03 Alias added: GHSA-6jm8-x3g6-r33j

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-23661 Soft Serve: SSRF via unvalidated LFS endpoint in repo import CVSS 3.1CRITICAL 9.1
  • TI-2025-39912 Soft Serve is vulnerable to SSRF through its Webhooks CVSS 3.1CRITICAL 9.1
  • TI-2023-23497 Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled CVSS 3.1HIGH 7.5
  • TI-2026-25759 Soft Serve: Authenticated repo import can clone server-local private repositories CVSS 4.0HIGH 7.1
  • TI-2026-19385 Soft Serve has Critical Authentication Bypass CVSS 4.0HIGH 8.1
  • TI-2025-16079 Soft Serve allows path traversal attacks CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences