BTCPay’s API key fix is merged, but its latest release still predates the patch
BTCPay Server merged a fix on Oct. 19 for an authorization flaw that could let broadly permissioned, store-scoped API keys access server-wide or account-wide functions. The patch limits store-grant fallback to store permissions and prevents callers from creating keys with more authority than their own grants allow. Tests cover attempts to access server roles, delete an account, and create an unrestricted key. The issue does not show that invoice-only keys could gain administrator powers, and server access still depends on the key owner’s administrator role. No exploitation, affected merchants, or losses were reported. Version 2.4.5 predates the change; the first affected version and a release containing the fix remain unclear. Merchants are advised to review delegated keys and restrict them to necessary permissions.
