CVE-2026-91773: Soft Serve Git LFS Information Disclosure

CVE-2026-91773 Overview

CVE-2026-91773 is an information disclosure vulnerability in Soft Serve, a self-hosted Git server maintained by Charmbracelet. Versions 0.7.1 through 0.11.6 fail to scope Git Large File Storage (LFS) lock queries by repository. Authenticated users with write access to any repository can enumerate lock IDs globally and read lock metadata from repositories they cannot access. The exposed data includes locked file paths, usernames, and lock timestamps from private repositories. The flaw maps to Insecure Direct Object Reference [CWE-639].

Critical Impact
Any authenticated user with write access to a single repository can enumerate LFS lock metadata across all repositories on the server, including private ones.

Affected Products

Charmbracelet Soft Serve 0.7.1 through 0.11.6
Self-hosted Git servers using Soft Serve with LFS locking enabled
Multi-tenant Soft Serve deployments with private repositories

Discovery Timeline

2026-09-15 - CVE-2026-91773 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91773

Vulnerability Analysis

Soft Serve implements Git LFS file locking to prevent concurrent edits of binary assets. The lock lookup path in pkg/store/database/lfs.go queries the lfs_locks table by primary key without also matching on the requesting repository. Because lock IDs are sequential integers issued globally, an authenticated user can iterate IDs and retrieve lock records that belong to repositories outside their access scope. Returned records include the locked path, owning username, and creation timestamp, which leaks file layout and contributor activity from private repositories.

Root Cause

The root cause is a missing tenant-scope check in the GetLFSLockByID store method. The SQL statement filtered only on lfs_locks.id, treating the ID as sufficient authorization. The caller's repository context was never joined to the query, so the database returned any matching lock regardless of ownership. This is a textbook Insecure Direct Object Reference [CWE-639] where object identifiers act as capabilities.

Attack Vector

Exploitation requires an authenticated account with write access to at least one repository on the target Soft Serve instance. The attacker calls the LFS locks API and iterates numeric lock IDs. Each successful response reveals metadata from another repository, including private ones. No user interaction is required, and the attack is fully network-based over the standard Git LFS transport.

// Vulnerable implementation before the patch
// GetLFSLockByID implements store.LFSStore.
-func (*lfsStore) GetLFSLockByID(ctx context.Context, tx db.Handler, id int64) (models.LFSLock, error) {
+func (*lfsStore) GetLFSLockByID(ctx context.Context, tx db.Handler, repoID int64, id int64) (models.LFSLock, error) {
 	var lock models.LFSLock
 	query := tx.Rebind(`
 		SELECT *
 		FROM lfs_locks
-		WHERE lfs_locks.id = ?;
+		WHERE id = ? AND repo_id = ?;
 	`)
-	err := tx.GetContext(ctx, &lock, query, id)
+	err := tx.GetContext(ctx, &lock, query, id, repoID)
 	return lock, db.WrapError(err)
 }

Source: GitHub Commit e349146

Detection Methods for CVE-2026-91773

Indicators of Compromise

Sequential enumeration of LFS lock IDs from a single authenticated session in Soft Serve access logs.
LFS lock verify or list requests referencing repositories the acting user has no membership in.
High-volume GET requests to /api/lfs/locks/verify or lock detail endpoints from one user in a short window.

Detection Strategies

Enable verbose request logging on the Soft Serve server and audit lock endpoint access grouped by user and repository.
Correlate authenticated user IDs against the repo_id in lock query responses to flag cross-tenant access.
Deploy web application firewall or reverse proxy rules that rate-limit LFS lock lookups per authenticated user.

Monitoring Recommendations

Ingest Soft Serve application and reverse proxy logs into a centralized SIEM for retention and query.
Alert on repeated 200 OK responses to LFS lock ID lookups originating from users without corresponding repository grants.
Monitor the lfs_locks table for unexpected read patterns using database audit logging where supported.

How to Mitigate CVE-2026-91773

Immediate Actions Required

Upgrade Soft Serve to the version containing commit e349146, which scopes GetLFSLockByID by repoID.
Restrict write access on the Soft Serve instance to trusted users until the patch is applied.
Review historical logs for suspicious enumeration of LFS lock IDs by low-privilege accounts.

Patch Information

The fix is available in commit e349146 of the Soft Serve repository. The patch adds a repo_id predicate to the lock lookup SQL and threads the repository identifier through the store interface GetLFSLockByID. Details are published in GitHub Security Advisory GHSA-xqg9-4q65-m2wf and the VulnCheck Soft Serve Advisory.

Workarounds

Disable Git LFS locking on sensitive repositories until the server is upgraded.
Limit account creation and write access grants on multi-tenant Soft Serve deployments.
Front the Soft Serve API with a reverse proxy that enforces per-user rate limits on LFS lock endpoints.

bash

# Verify the running Soft Serve version and upgrade past 0.11.6
soft --version

# Example: pull the fixed source and rebuild
git clone https://github.com/charmbracelet/soft-serve.git
cd soft-serve
git checkout e34914699128c937afad167d43ccb5310e48b319
go build ./cmd/soft