CVE-2026-22253: Soft Serve Auth Bypass Vulnerability

CVE-2026-22253 Overview

CVE-2026-22253 is an authorization bypass vulnerability affecting Soft Serve, a self-hostable Git server for the command line. Prior to version 0.11.2, the LFS (Large File Storage) lock deletion endpoint contains a critical flaw that allows any authenticated user with repository write access to delete locks owned by other users by setting the force flag. This weakness is classified under CWE-863 (Incorrect Authorization).

Critical Impact

Authenticated users can bypass lock ownership validation and delete LFS locks belonging to other users, potentially disrupting collaborative workflows and causing data integrity issues in repositories.

Affected Products

• Soft Serve versions prior to 0.11.2
• Self-hosted Git server deployments using Soft Serve LFS functionality
• Environments with multiple users utilizing LFS file locking features

Discovery Timeline

• 2026-01-08 - CVE-2026-22253 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-22253

Vulnerability Analysis

This authorization bypass vulnerability exists in the LFS lock deletion functionality within Soft Serve's web handling code. The root issue stems from the order of operations in the lock deletion code path—specifically, force deletion requests are processed before the user context is retrieved and validated. This architectural flaw means that ownership checks are completely bypassed when an attacker sets the force flag in their deletion request.

In a properly secured implementation, ownership validation should occur before any deletion action is taken, regardless of the force flag status. The vulnerability allows any authenticated user with write access to a repository to arbitrarily delete locks created by other users, undermining the collaborative locking mechanism that LFS provides for managing large binary files.

Root Cause

The vulnerable code path in pkg/web/git_lfs.go processes force deletions before retrieving user context, which means the ownership validation logic is never executed for force delete requests. This represents a classic authorization bypass where the security check is placed after the action occurs or in a code path that can be circumvented entirely.

Attack Vector

An attacker with authenticated write access to a repository can exploit this vulnerability by sending a lock deletion request with the force flag enabled. The attack is network-accessible and requires low privileges (repository write access), with no user interaction required. The attacker simply needs to:

1. Authenticate to the Soft Serve instance
2. Identify a target lock ID belonging to another user
3. Send a DELETE request to the LFS lock endpoint with the force parameter set to true
4. The lock is deleted without ownership verification

// Security patch in pkg/web/git_lfs.go
// The fix ensures proper authorization checks before processing deletions
 	return
 }

-	// Delete another user's lock
 l := lfs.Lock{
 	ID:       strconv.FormatInt(lock.ID, 10),
 	Path:     lock.Path,

Source: GitHub Commit

Detection Methods for CVE-2026-22253

Indicators of Compromise

• Unusual patterns of LFS lock deletions, particularly force deletions performed by users who did not create the original locks
• Log entries showing lock deletion requests with force flag from users other than the lock owner
• Complaints from repository collaborators about unexpectedly released file locks

Detection Strategies

• Monitor LFS lock deletion API endpoints for requests containing the force parameter
• Implement audit logging to track the relationship between lock owners and deletion requesters
• Review access logs for patterns indicating systematic lock deletions by non-owners

Monitoring Recommendations

• Enable verbose logging for LFS operations in Soft Serve
• Configure alerting for force deletion requests on critical repositories
• Periodically audit lock ownership and deletion history for anomalies

How to Mitigate CVE-2026-22253

Immediate Actions Required

• Upgrade Soft Serve to version 0.11.2 or later immediately
• Audit recent LFS lock deletion activity to identify potential exploitation
• Review repository access permissions and restrict write access where appropriate
• Consider temporarily disabling LFS lock functionality until the patch is applied

Patch Information

The vulnerability has been patched in Soft Serve version 0.11.2. The fix ensures that user context and ownership validation occurs before processing any lock deletion request, regardless of the force flag status. The security patch is available via the GitHub commit and detailed in the GitHub Security Advisory.

Workarounds

• Restrict repository write access to only trusted users until the patch can be applied
• Implement network-level access controls to limit who can reach the Soft Serve LFS endpoints
• Monitor and alert on all force deletion requests as a compensating control

# Configuration example
# Upgrade Soft Serve to patched version
# Using Go installation
go install github.com/charmbracelet/soft-serve/cmd/soft@v0.11.2

# Verify installed version
soft --version
# Expected output: soft version 0.11.2 or higher