Vulnerabilities

Vulnerability · GHSA-f3fj-9625-rv3m

charmbracelet/soft-serve: Race in leaves a private repository readable by unauthenticated users

Published Oct 30, 2026 · catalog updated Oct 30, 2026 · charmbracelet/soft-serve: Race in leaves

Last checked Nov 4, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-f3fj-9625-rv3m. A missing EPSS score is not a low risk. Compare charmbracelet/soft-serve: Race in leaves with the linked advisory before you change production.

Severity

Medium5.9

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Advisory link

Affected products

Go github.com/charmbracelet/soft-serve

## Summary Soft Serve cached repository records in memory with no expiry, and trusted the cached record for every access check. cleared the cached record before it saved the new visibility, and not afterwards. A request that arrived between the two read the old, public record from the database and cached it after the change was saved. From then on every access check used that stale record, so a repository the operator had just made private stayed readable by unauthenticated users over HTTP, SSH, and until the server restarted. ## Impact An unauthenticated attacker can keep reading a repository after it is made private, including everything pushed to it afterwards. The attacker needs no account and no timing knowledge: a client polling , which the default allows, will eventually land in the window when the operator changes the visibility. The stale record lasts until the server restarts or the entry is evicted, and the operator gets no sign of it. reads the database directly and reports , and the webhook is not sent, because its check reads the same stale record. Write access is not gained. Because the repository was public until the change, an attacker able to win the race could already read its contents up to that point. What this adds is continued access to everything pushed after the operator made it private. Deployments that run several Soft Serve processes against one shared database were affected more broadly. Each process kept its own cache, so a visibility change made through one process never reached the others, with no race required. Reachable over HTTP, SSH, and (AV:N). Success depends on a visibility change made by the operator, which the attacker does not control (AC:H). No privileges are required under the default anonymous read access (PR:N), and the attacker interacts with no one, since the operator's change is already captured by AC:H (UI:N). Continued read access to a repository its owner has made private is a high confidentiality impact (C:H), wit