Authorization Bypass in Soft Serve Git Server by Charmbracelet

CVE-2026-22253

What is CVE-2026-22253?

Soft Serve, a self-hosted Git server, contains an authorization bypass vulnerability in its LFS lock deletion endpoint. This flaw allows any authenticated user with write access to repositories to delete locks owned by other users by employing the force flag. The vulnerability occurs because the code responsible for processing deletions does not validate user ownership before executing force deletions. Version 0.11.2 addresses this issue, ensuring proper ownership validation is in place.

References