CVE-2026-91773 is an authorization bypass vulnerability in charmbracelet's Soft Serve affecting versions 0.7.1 through 0.11.6. The flaw arises because Git LFS lock queries are not scoped by repository, enabling authenticated users with write access to any repository to access lock metadata from other repositories they do not have permission to access. This metadata includes locked file paths, usernames, and lock timestamps, potentially exposing sensitive information about private repositories.

The vulnerability allows unauthorized disclosure of Git LFS lock metadata from private repositories. While it does not grant direct code or data access, it leaks information about locked files and user activity, which could aid further reconnaissance or targeted attacks. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, and limited impact confined to information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write access to trusted users only and monitor repository permissions carefully to limit exposure. Avoid granting unnecessary write permissions to reduce risk.