CVE-2026-22253

{"id": "CVE-2026-22253", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22253", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T18:51:06.311629Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "charmbracelet", "product": "soft-serve", "versions": [{"status": "affected", "version": "< 0.11.2"}]}]}], "published": "2026-01-08T19:15:59.950", "references": [{"url": "https://github.com/charmbracelet/soft-serve/commit/000ab5164f0be68cf1ea6b6e7227f11c0e388a42", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-6jm8-x3g6-r33j", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypass in the LFS lock deletion endpoint allows any authenticated user with repository write access to delete locks owned by other users by setting the force flag. The vulnerable code path processes force deletions before retrieving user context, bypassing ownership validation entirely. This issue has been patched in version 0.11.2."}, {"lang": "es", "value": "Soft Serve es un servidor Git autoalojable para la l\u00ednea de comandos. Antes de la versi\u00f3n 0.11.2, una omisi\u00f3n de autorizaci\u00f3n en el endpoint de eliminaci\u00f3n de bloqueos LFS permite a cualquier usuario autenticado con acceso de escritura al repositorio eliminar bloqueos propiedad de otros usuarios al establecer la bandera de forzado. La ruta de c\u00f3digo vulnerable procesa las eliminaciones forzadas antes de recuperar el contexto del usuario, omitiendo completamente la validaci\u00f3n de propiedad. Este problema ha sido parcheado en la versi\u00f3n 0.11.2."}], "lastModified": "2026-06-17T10:19:38.473", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:charm:soft_serve:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "4E11AA52-59BD-42E8-AF0F-EF9490942F6C", "versionEndExcluding": "0.11.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}