CyberRota Analysis
AI-GeneratedSoft Serve versions 0.7.1 through 0.11.6 are vulnerable due to inadequate scoping of Git LFS lock queries, enabling authenticated users to access lock metadata from unauthorized repositories. This flaw allows attackers with write access to any repository to enumerate global lock IDs, potentially exposing sensitive information such as locked file paths, usernames, and timestamps from private repositories. Organizations using affected versions should prioritize remediation to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames, and lock timestamps from private repositories.