PT-2026-91832

CVE-2026-91773

Published

2026-09-15

Updated

2026-09-15

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Soft Serve versions 0.7.1 through 0.11.6

Description Authenticated users can read lock metadata from repositories they are not authorized to access because Git LFS (Large File Storage) lock queries are not scoped by repository. An attacker with write access to any repository can globally enumerate lock IDs to recover usernames, lock timestamps, and locked file paths from private repositories.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

George Chen

Sondt99

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers