{"id":"GHSA-f3fj-9625-rv3m","kind":"vulnerability","aliases":["GHSA-f3fj-9625-rv3m"],"related":[],"title":"charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users","description":"## Summary\n\nSoft Serve cached repository records in memory with no expiry, and trusted the cached record for every access check. `SetPrivate` cleared the cached record before it saved the new visibility, and not afterwards.\n\nA request that arrived between the two read the old, public record from the database and cached it after the change was saved. From then on every access check used that stale record, so a repository the operator had just made private stayed readable by unauthenticated users over HTTP, SSH, and `git://` until the server restarted.\n\n## Impact\n\nAn unauthenticated attacker can keep reading a repository after it is made private, including everything pushed to it afterwards. The attacker needs no account and no timing knowledge: a client polling `GET /<repo>.git/info/refs?service=git-upload-pack`, which the default `anon-access: read-only` allows, will eventually land in the window when the operator changes the visibility.\n\nThe stale record lasts until the server restarts or the entry is evicted, and the operator gets no sign of it. `repo private <name>` reads the database directly and reports `true`, and the `visibility_change` webhook is not sent, because its check reads the same stale record.\n\nWrite access is not gained. Because the repository was public until the change, an attacker able to win the race could already read its contents up to that point. What this adds is continued access to everything pushed after the operator made it private.\n\nDeployments that run several Soft Serve processes against one shared database were affected more broadly. Each process kept its own cache, so a visibility change made through one process never reached the others, with no race required.\n\nReachable over HTTP, SSH, and `git://` (AV:N). Success depends on a visibility change made by the operator, which the attacker does not control (AC:H). No privileges are required under the default anonymous read access (PR:N), and the attacker interacts with no one, since the operator's change is already captured by AC:H (UI:N). Continued read access to a repository its owner has made private is a high confidentiality impact (C:H), with no integrity or availability impact (I:N, A:N).\n\n## Root Cause\n\nThe cache was the source of truth for access checks, and clearing it was treated as a step before the write rather than after it.\n\n`Backend.Repository` in `pkg/backend/repo.go` returned the cached record when present, and on a miss read the database and stored the result. The cache was a plain LRU of 1000 entries with no expiry (`pkg/backend/cache.go`), and `AccessLevelForUser` read the private flag from that record.\n\n`SetPrivate` ran in this order:\n\n```go\nd.cache.Delete(name)\n... d.db.TransactionContext(ctx, func(tx *db.Tx) error {\n\t... writes or removes git-daemon-export-ok ...\n\treturn d.store.SetRepoIsPrivateByName(ctx, tx, name, private)\n})\n```\n\nA reader that missed the cache after the `Delete` but read the database before the commit got the old row, and stored it after the commit. Nothing ever cleared it again.\n\n`SetHidden`, `SetMirror`, `SetDescription`, and `SetProjectName` cleared the cache in the same place. `DeleteRepository` and `RenameRepository` deferred the clear inside the transaction function, which also runs before the commit.\n\nMoving the clear to after the commit would not have been enough on its own. A reader that read the old row before the commit could still store it after the clear.\n\n## Affected Versions\n\nv0.6.0 through v0.12.2. The repository cache and this ordering arrived with the database-backed backend in commit `e398b4d` (`refactor: implement database module and abstract backend`, #337), first released in v0.6.0. Versions v0.5.x used a different backend and were not assessed.\n\n## Patches\n\nFixed in `v0.12.3`.\n\nThe repository cache is removed. Every lookup now reads the database, so an access check always sees the visibility most recently saved, whether by this process or any other sharing the database.\n\nRemoving the cache was preferred over making it race-free. A database lookup costs tens of microseconds on SQLite, which is small next to the Git work behind each request, while keeping the cache correct needed a versioning scheme around every write and still left multi-process deployments stale. Without the cache, the whole class of stale-authorization bugs goes away rather than this one instance.\n\nThe `visibility_change` webhook is also fixed in the same release. It now compares against the visibility saved before the change, so it fires when visibility actually changes and only then.\n\n## Workarounds\n\nIt is recommended to upgrade to the patched release.\n\nNo configuration closes the race. Restarting the server clears a stale record and restores correct access checks until the next visibility change. Operators who cannot upgrade immediately should create repositories as private from the start (`repo create -p`) rather than making public ones private, and avoid changing visibility while the server is serving traffic.","summary":"Soft Serve cached repository visibility in memory without expiry, and a race during a visibility change could store the old public record after the change. An unauthenticated attacker can keep reading a repository after its owner made it private, including new pushes, over HTTP, SSH, and git://, until the server restarts.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/charmbracelet/soft-serve","fixed":["0.12.3"],"affected":">= 0.6.0, < 0.12.3","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-362","cwe-367","git","go","package","self-hosted","soft-serve"],"not_affected_if":["no-visibility-changes","not-running-soft-serve","private-from-creation"],"how_to_check":"- Check the Soft Serve version with `soft --version` or the `go.mod` entry for `github.com/charmbracelet/soft-serve`; affected versions are `0.6.0` through `0.12.2`.\n- Note whether several Soft Serve processes share one database, since that case was affected more broadly.\n- Check whether `anon-access` is `read-only` in the server config; the default allows anonymous reads.","fix":"- Upgrade Soft Serve to `0.12.3`.","status":"open","published_at":"2026-10-30T14:53:57+00:00","first_seen_at":"2026-10-30T14:56:57+00:00","triaged_at":"2026-10-30T14:57:33+00:00","updated_at":"2026-10-30T14:57:33+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-30T14:57:33Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Soft Serve to `0.12.3`.","reach":"internet","title":"Soft Serve: race leaves made-private repositories readable by anonymous users","impact":"medium","summary":"Soft Serve cached repository visibility in memory without expiry, and a race during a visibility change could store the old public record after the change. An unauthenticated attacker can keep reading a repository after its owner made it private, including new pushes, over HTTP, SSH, and git://, until the server restarts.","audience":"developers","category":"package","nicknames":[],"who_cares":["soft-serve","self-hosted","git","go"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Anonymous users read a repository after it was made private.","analyst_note":"","how_to_check":"- Check the Soft Serve version with `soft --version` or the `go.mod` entry for `github.com/charmbracelet/soft-serve`; affected versions are `0.6.0` through `0.12.2`.\n- Note whether several Soft Serve processes share one database, since that case was affected more broadly.\n- Check whether `anon-access` is `read-only` in the server config; the default allows anonymous reads.","plain_action":"","needs_analyst":false,"not_affected_if":["private-from-creation","no-visibility-changes","not-running-soft-serve"],"who_is_affected":"Teams that run a Soft Serve server and change repositories from public to private while it serves traffic. The default anonymous read-only access makes the race reachable without an account, and multi-process deployments sharing one database were affected more broadly. Teams that only run Soft Serve with private repositories from creation, or that do not use it, can skip it; the advisory notes restarting clears a stale record until the next visibility change.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000894,"input_tokens":5754,"output_tokens":638,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-362':27B '-367':29B '/charmbracelet/soft-serve':25A '1000':505C '337':667C '9625':16A,21A 'abl':300C 'abstract':665C 'ac':389C,419C 'access':107C,150C,222C,286C,319C,400C,425C,461C,699C 'accesslevelforus':512C 'account':202C 'add':316C 'affect':341C,639C 'afterward':122C,197C 'allow':226C 'alreadi':306C,416C 'also':602C 'alway':701C 'anon':221C 'anon-access':220C 'anonym':398C 'arriv':126C,650C 'assess':681C 'attack':66B,181C,199C,299C,385C,405C 'av':371C 'avail':445C 'back':655C 'backend':656C,666C,677C 'backend.repository':478C 'broad':343C 'c':439C 'cach':41B,92C,103C,112C,139C,349C,454C,483C,499C,553C,586C,646C,688C 'captur':417C 'caus':452C 'chang':54B,63B,143C,236C,272C,297C,353C,378C,414C 'charmbracelet/soft-serve':1A 'check':108C,151C,279C,462C,700C 'clear':110C,464C,576C,584C,596C,609C,638C 'client':208C 'commit':563C,573C,606C,613C,631C,658C 'confidenti':437C 'content':309C 'continu':318C,423C 'control':388C 'could':55B,305C,632C 'ctx':529C,544C 'cwe':26B,28B 'd.cache.delete':526C 'd.db.transactioncontext':528C 'd.store.setrepoisprivatebyname':543C 'daemon':539C 'databas':137C,264C,339C,493C,560C,654C,662C,696C,717C 'database-back':653C 'db.tx':532C 'default':219C,397C 'defer':594C 'delet':556C 'deleterepositori':591C 'depend':374C 'deploy':329C 'differ':676C 'direct':265C 'e398b4d':659C 'enough':618C 'entri':249C,506C 'error':533C 'eventu':228C 'ever':575C 'everi':106C,149C,691C 'everyth':193C,321C 'evict':251C 'expiri':47B,99C,509C 'export':540C 'f3fj':15A,20A 'first':668C 'fix':683C 'flag':516C 'func':530C 'function':600C 'gain':289C 'get':210C,255C 'ghsa':14A,19A 'ghsa-f3fj':13A,18A 'git':30B,214C,538C 'git-daemon-export-ok':537C 'git-upload-pack':213C 'git/info/refs':211C 'github.com':24A 'github.com/charmbracelet/soft-serve':23A 'go':31B,525C 'got':564C 'h':390C,420C,440C 'high':436C 'host':35B 'http':82B,171C,368C 'impact':178C,438C,446C 'implement':661C 'includ':78B,192C 'insid':597C 'integr':443C 'interact':406C 'keep':68B,183C 'kept':346C 'knowledg':206C 'land':229C 'last':242C 'leav':5A 'lookup':692C 'lru':503C 'made':75B,163C,190C,326C,354C,379C,432C 'memori':45B,96C 'miss':490C,551C 'modul':663C 'move':607C 'n':372C,402C,422C,448C,450C 'name':527C,546C 'need':200C 'never':358C 'new':79B,118C 'noth':574C 'ok':541C 'old':58B,132C,566C,627C 'one':337C,356C,409C 'oper':160C,235C,254C,325C,382C,412C 'order':524C,649C 'other':361C 'owner':74B,430C 'pack':216C 'packag':32B 'patch':682C 'pkg/backend/cache.go':510C 'pkg/backend/repo.go':480C 'place':590C 'plain':502C 'point':313C 'poll':209C 'pr':401C 'present':486C 'privat':7A,77B,164C,191C,261C,328C,433C,515C,547C 'privileg':392C 'process':335C,345C,357C,711C 'public':59B,133C,294C 'push':80B,194C,322C 'race':2A,50B,304C,364C 'ran':521C 'rather':474C 'reach':359C 'reachabl':366C 'read':69B,130C,184C,224C,262C,280C,307C,399C,424C,491C,513C,558C,625C,694C 'read-on':223C 'readabl':9A,166C 'reader':549C,623C 'recent':706C 'record':60B,94C,104C,113C,134C,155C,241C,284C,484C,519C 'refactor':660C 'releas':669C 'remov':536C,690C,718C 'renamerepositori':593C 'repo':260C 'report':267C 'repositori':8A,42B,71B,93C,158C,186C,292C,428C,645C,687C 'request':124C 'requir':365C,394C 'restart':88B,177C,246C 'result':497C 'return':481C,542C 'root':451C 'row':567C,628C 'run':331C,603C 'rv3m':17A,22A 'save':116C,145C,707C 'see':702C 'self':34B 'self-host':33B 'sent':276C 'serv':38B,40B,91C,334C 'server':87B,176C,245C 'servic':212C 'setdescript':581C 'sethidden':579C 'setmirror':580C 'setpriv':4A,109C,520C 'setprojectnam':583C 'sever':332C 'share':338C,715C 'sign':257C 'sinc':410C 'soft':37B,39B,90C,333C 'soft-serv':36B 'sourc':457C 'ssh':83B,172C,369C 'stale':154C,240C,283C 'stay':165C 'step':470C 'still':633C 'store':56B,495C,569C,634C 'success':373C 'summari':89C 'th':719C 'time':205C 'transact':599C 'treat':467C 'true':268C 'trust':101C 'truth':459C 'two':129C 'tx':531C,545C 'ui':421C 'unauthent':11A,65B,168C,180C 'upload':215C 'use':152C,674C 'user':12A,169C 'v0.12.2':643C 'v0.12.3':685C 'v0.5.x':673C 'v0.6.0':641C,671C 'version':640C,672C 'visibl':43B,53B,119C,238C,271C,352C,377C,704C 'webhook':273C 'whether':708C 'win':302C 'window':232C 'without':46B 'would':614C 'write':285C,473C,534C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a Soft Serve server and change repositories from public to private while it serves traffic. The default anonymous read-only access makes the race reachable without an account, and multi-process deployments sharing one database were affected more broadly. Teams that only run Soft Serve with private repositories from creation, or that do not use it, can skip it; the advisory notes restarting clears a stale record until the next visibility change.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T14:53:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-f3fj-9625-rv3m","url":"https://github.com/advisories/GHSA-f3fj-9625-rv3m","severity":"medium","published_at":"2026-10-30T14:53:57+00:00","modified_at":"2026-10-30T14:54:00+00:00","first_seen_at":"2026-10-30T14:56:57+00:00","fetched_at":"2026-10-30T14:56:57+00:00","note":null}],"documents":[{"id":24033,"url":"https://api.github.com/repos/charmbracelet/soft-serve/security-advisories/GHSA-f3fj-9625-rv3m","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":24034,"url":"https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-f3fj-9625-rv3m","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":24035,"url":"https://github.com/charmbracelet/soft-serve/commit/0a4e6f0b7e063927c7128756e1c1b3db871edabf","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":24036,"url":"https://github.com/charmbracelet/soft-serve/commit/5b307b4da4db285f797cc028b381ba4d3d853019","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":24037,"url":"https://github.com/charmbracelet/soft-serve/commit/e398b4dde723437f637b06710e0938d349b360e8","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":24002,"url":"https://github.com/charmbracelet/soft-serve/releases/tag/v0.12.3","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}