CVE-2026-22253

Soft Serve is missing an authorization check in LFS lock deletion

Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypass in the LFS lock deletion endpoint allows any authenticated user with repository write access to delete locks owned by other users by setting the force flag. The vulnerable code path processes force deletions before retrieving user context, bypassing ownership validation entirely. This issue has been patched in version 0.11.2.

Affected

charmbracelet · soft-serve

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

EPSS

0.30% chance of exploitation in the next 30 days, 22nd percentile

Published

2026-01-08

Proof-of-concept exploits (1)

• advisories/GHSA-6jm8-x3g6-r33j

Security advisories

• charmbracelet/soft-serve/security/advisories/GHSA-6jm8-x3g6-r33j
• charmbracelet/soft-serve/commit/000ab5164f0be68cf1ea6b6e7227f11c0e388a42

References

• CVE Record
• NVD entry