CVE-2026-22253: Soft Serve Auth Bypass Vulnerability

CVE-2026-22253 Overview

CVE-2026-22253 is an authorization bypass vulnerability affecting Soft Serve, a self-hostable Git server for the command line. Prior to version 0.11.2, the LFS (Large File Storage) lock deletion endpoint contains a critical flaw that allows any authenticated user with repository write access to delete locks owned by other users by setting the force flag. This weakness is classified under CWE-863 (Incorrect Authorization).

Critical Impact
Authenticated users can bypass lock ownership validation and delete LFS locks belonging to other users, potentially disrupting collaborative workflows and causing data integrity issues in repositories.

Affected Products

Soft Serve versions prior to 0.11.2
Self-hosted Git server deployments using Soft Serve LFS functionality
Environments with multiple users utilizing LFS file locking features

Discovery Timeline

2026-01-08 - CVE-2026-22253 published to NVD
2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-22253

Vulnerability Analysis

This authorization bypass vulnerability exists in the LFS lock deletion functionality within Soft Serve's web handling code. The root issue stems from the order of operations in the lock deletion code path—specifically, force deletion requests are processed before the user context is retrieved and validated. This architectural flaw means that ownership checks are completely bypassed when an attacker sets the force flag in their deletion request.

In a properly secured implementation, ownership validation should occur before any deletion action is taken, regardless of the force flag status. The vulnerability allows any authenticated user with write access to a repository to arbitrarily delete locks created by other users, undermining the collaborative locking mechanism that LFS provides for managing large binary files.

Root Cause

The vulnerable code path in pkg/web/git_lfs.go processes force deletions before retrieving user context, which means the ownership validation logic is never executed for force delete requests. This represents a classic authorization bypass where the security check is placed after the action occurs or in a code path that can be circumvented entirely.

Attack Vector

An attacker with authenticated write access to a repository can exploit this vulnerability by sending a lock deletion request with the force flag enabled. The attack is network-accessible and requires low privileges (repository write access), with no user interaction required. The attacker simply needs to:

Authenticate to the Soft Serve instance
Identify a target lock ID belonging to another user
Send a DELETE request to the LFS lock endpoint with the force parameter set to true
The lock is deleted without ownership verification

// Security patch in pkg/web/git_lfs.go
// The fix ensures proper authorization checks before processing deletions
 	return
 }

-	// Delete another user's lock
 l := lfs.Lock{
 	ID:       strconv.FormatInt(lock.ID, 10),
 	Path:     lock.Path,

Source: GitHub Commit

Detection Methods for CVE-2026-22253

Indicators of Compromise

Unusual patterns of LFS lock deletions, particularly force deletions performed by users who did not create the original locks
Log entries showing lock deletion requests with force flag from users other than the lock owner
Complaints from repository collaborators about unexpectedly released file locks

Detection Strategies

Monitor LFS lock deletion API endpoints for requests containing the force parameter
Implement audit logging to track the relationship between lock owners and deletion requesters
Review access logs for patterns indicating systematic lock deletions by non-owners

Monitoring Recommendations

Enable verbose logging for LFS operations in Soft Serve
Configure alerting for force deletion requests on critical repositories
Periodically audit lock ownership and deletion history for anomalies

How to Mitigate CVE-2026-22253

Immediate Actions Required

Upgrade Soft Serve to version 0.11.2 or later immediately
Audit recent LFS lock deletion activity to identify potential exploitation
Review repository access permissions and restrict write access where appropriate
Consider temporarily disabling LFS lock functionality until the patch is applied

Patch Information

The vulnerability has been patched in Soft Serve version 0.11.2. The fix ensures that user context and ownership validation occurs before processing any lock deletion request, regardless of the force flag status. The security patch is available via the GitHub commit and detailed in the GitHub Security Advisory.

Workarounds

Restrict repository write access to only trusted users until the patch can be applied
Implement network-level access controls to limit who can reach the Soft Serve LFS endpoints
Monitor and alert on all force deletion requests as a compensating control

bash

# Configuration example
# Upgrade Soft Serve to patched version
# Using Go installation
go install github.com/charmbracelet/soft-serve/cmd/soft@v0.11.2

# Verify installed version
soft --version
# Expected output: soft version 0.11.2 or higher