BTCPay 2.4.5 still lacks merged API key permission fix

BTCPay Server merged a fix on October 19 to prevent broad store-scoped API keys from satisfying server-wide or account-wide permission checks. The update, identified as pull request #7684, addresses a gap that could allow credentials with extensive permissions for a single store to access broader administrative functions. As of October 26, version 2.4.5 remained the latest listed release on the project’s release list, and that build does not include the newly merged patch.

Permission Boundary Changes

Nicolas Dorier merged the fix into the project’s master development branch. BTCPay’s authentication documentation describes API keys as integration credentials restricted by two separate limits: the specific permissions an application may exercise and the store scope in which those permissions apply. The vulnerability existed in a fallback mechanism used when a request had no resolved scope. Previously, this fallback could accept a grant from any store to satisfy server-wide or account-wide checks. The merged change narrows this fallback so that accepting a grant from any store is now permitted only for store-level permissions. It no longer satisfies checks for server-wide or account-wide access.

The pull request includes regression tests to verify these boundaries. One test uses an administrator-owned key with unrestricted permissions scoped to a single store and asserts that the key must be denied access to server roles. Another test uses an ordinary user’s key with similar broad store-scoped grants and asserts that the key must be denied the ability to delete that user’s account. These tests confirm that broad authority over actions within a store does not translate to administrative powers at the server level, provided the owner’s role and specific grants are correctly evaluated.

Key Creation and Release Status

The patch also modifies how key creation requests are handled to prevent an authorized call from producing a credential more powerful than the caller’s own grants. The controller change adds a check that compares the requested permissions against the caller’s existing grants after entry requirements are met. For example, an added test asserts rejection when an administrator’s key, limited to server-settings authority, requests an unrestricted, unscoped key. Existing unscoped administrator keys retain their current behavior according to the pull request description.

Key creation endpoints have distinct entry requirements. The self-service endpoint requires unrestricted authority without a store scope, while the administrator’s user-targeted endpoint requires server-settings modification authority. The public pull request does not report confirmed exploitation, specific affected merchants, or financial losses. The first affected version of the software remains unclear. Version 2.4.5, dated October 6, retains the earlier authorization handler and key controller logic that the pull request modifies. BTCPay’s documentation recommends that merchants request the narrowest useful permissions for their integrations and review delegated keys for broad grants. The next concrete remediation milestone is the publication of a release containing pull request #7684, followed by confirmation that deployed builds include the patch.