The added regression assessments use keys with unrestricted permissions scoped to a single retailer: broad authority over actions, with a separate restrict on the place they apply. One asserts that an administrator-owned key should be denied entry to server roles. One other asserts that an odd person’s key should be denied deletion of that person’s account.
These examples contain broad store-scoped grants. They don’t set up that an invoice-only key can acquire administrator powers. Server-level entry additionally relies on the proprietor’s administrator position.
The authorization change narrows a fallback used when a request has no resolved scope: accepting a grant from any retailer is now allowed just for retailer permissions. That fallback not satisfies server-wide or account-wide checks. Based on the PR description, present unscoped administrator keys retain their conduct.
To stop a licensed key-creation name from producing a extra highly effective credential, the patch additionally checks requested permissions in opposition to the caller’s grants. An added take a look at asserts rejection when an administrator’s key restricted to server-settings authority requests an unrestricted, unscoped key.
Key creation nonetheless has separate entry necessities. The self-service endpoint requires unrestricted authority with no retailer scope; the administrator’s user-targeted endpoint requires server-settings modification authority. The controller change provides a verify on what the caller might grant after these necessities are met.
The general public PR doesn’t report confirmed exploitation, affected retailers or losses.
Model 2.4.5’s tagged authorization handler and key controller retain the sooner checks modified by this PR. The primary affected model stays unclear.
BTCPay’s documentation recommends requesting the narrowest helpful permissions. Retailers can overview delegated keys for broad grants and their house owners’ privileges, then slender permissions to what every integration wants. The following concrete remediation milestone is a printed launch containing PR #7684, adopted by affirmation that the deployed construct consists of it.
