CVE-2026-22253
Medium · 5.4CVSS
5.4
EPSS
0.3%
Published
Jan 8, 2026
CISA due date
—
The record
Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypass in the LFS lock deletion endpoint allows any authenticated user with repository write access to delete locks owned by other users by setting the force flag. The vulnerable code path processes force deletions before retrieving user context, bypassing ownership validation entirely. This issue has been patched in version 0.11.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/charmbracelet/soft-serve | 0 | 0.11.2 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260114T191543-150000.1.137.1 |
Related vulnerabilities
- GO-2026-4290 Soft Serve is missing an authorization check in LFS lock deletion in… Same vulnerability
- GO-2026-4353 Soft Serve Affected by an Authentication Bypass in github.com/charmbracelet/soft-serve Also affects github.com/charmbracelet/soft-serve
- CVE-2026-24058 Soft Serve is a self-hostable Git server for the command line. Also affects github.com/charmbracelet/soft-serve
- GO-2025-4111 Soft Serve is vulnerable to SSRF through its Webhooks in… Also affects github.com/charmbracelet/soft-serve
- GO-2025-4106 Soft Serve does not sanitize ANSI escape sequences in user input in… Also affects github.com/charmbracelet/soft-serve
- CVE-2025-64522 Soft Serve is vulnerable to SSRF through its Webhooks Also affects github.com/charmbracelet/soft-serve
- CVE-2025-64494 Soft Serve is a self-hostable Git server for the command line. Also affects github.com/charmbracelet/soft-serve
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb