CVE-2026-22253: Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypass in the LFS lock deletion endpoint allows any…

PriorityP432medium5.4CVSS 3.1

AVNACLPRLUINSUCNILAL

EPSS

0.27%

19.0th percentile

Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypass in the LFS lock deletion endpoint allows any authenticated user with repository write access to delete locks owned by other users by setting the force flag. The vulnerable code path processes force deletions before retrieving user context, bypassing ownership validation entirely. This issue has been patched in version 0.11.2.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
charm	soft_serve	< 0.11.2	0.11.2
charmbracelet	soft-serve	< 0.11.2	0.11.2
github.com	charmbracelet_soft-serve	>= 0 < 0.11.2	0.11.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.