The October 19 merge restricts broad store-scoped grants, while the latest listed release still predates the change.
BTCPay Server, software for accepting Bitcoin payments, merged a fix on Oct. 19 for a gap that could let API keys with broad permissions for one store reach server-wide or account-wide functions. For merchants sharing such credentials with an integration, the risk is delegating more authority than intended.
Nicolas Dorier merged PR #7684 into the project's master development branch. As of Oct. 26, BTCPay's release list still identifies version 2.4.5, dated Oct. 6, as its latest release.
BTCPay's authentication documentation describes API keys as integration credentials restricted by permission and store. Those are separate limits: what an application may do, and which store it may act on.
The added regression tests use keys with unrestricted permissions scoped to a single store: broad authority over actions, with a separate limit on where they apply. One asserts that an administrator-owned key must be denied access to server roles. Another asserts that an ordinary user's key must be denied deletion of that user's account.
These examples involve broad store-scoped grants. They do not establish that an invoice-only key can obtain administrator powers. Server-level access also depends on the owner's administrator role.
The authorization change narrows a fallback used when a request has no resolved scope: accepting a grant from any store is now allowed only for store permissions. That fallback no longer satisfies server-wide or account-wide checks. According to the PR description, existing unscoped administrator keys retain their behavior.
Source link
