Vulnerability GO-2026-6891
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
9 hours ago
November 05, 2026 at 10:54 PM UTC
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users in github.com/charmbracelet/soft-serve
>=0.6.0 <0.12.3
>=0.6.0 <0.12.3
Summary
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users in github.com/charmbracelet/soft-serve
Details
charmbracelet/soft-serve: Race in SetPrivate leaves a private repository readable by unauthenticated users in github.com/charmbracelet/soft-serve
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
9 hours ago
charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories in github.com/charmbracelet/soft-serve
>=0.5.0 <0.12.3 GO-2026-6892
>=0.5.0 <0.12.3 GO-2026-6892
Medium Risk
6 days ago
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users
>=0.6.0 <0.12.3 GHSA-f3fj-9625-rv3m
>=0.6.0 <0.12.3 GHSA-f3fj-9625-rv3m
Medium Risk
6 days ago
charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories
>=0.5.0 <0.12.3 GHSA-fgxm-5hvv-x4vh
>=0.5.0 <0.12.3 GHSA-fgxm-5hvv-x4vh
Unknown
7 months ago
In Soft Serve, an authenticated repo import can clone server-local private repositories in github.com/charmbracelet/soft-serve
>=0.6.0 <0.11.6 GO-2026-4788
>=0.6.0 <0.11.6 GO-2026-4788
High Risk
7 months ago
In Soft Serve, an authenticated repo import can clone server-local private repositories
>=0.6.0 <0.11.6 GHSA-xgxp-f695-6vrp
>=0.6.0 <0.11.6 GHSA-xgxp-f695-6vrp
Impacted packages
Timeline
Published
9 hours ago
November 05, 2026 at 10:54 PM UTC
Fixed (v0.12.3)
1 month ago
October 05, 2026 at 03:23 PM UTC
Last Modified
8 hours ago
November 05, 2026 at 11:15 PM UTC