BTCPay Server merged a fix on October 19 to prevent API keys with broad permissions for a single store from accessing server-wide or account-wide functions. Server-wide access remains tied to the owner’s administrator role, while key creation is subject to separate access requirements. As of October 26, version 2.4.5, released on October 6, remained the latest available version and retained the earlier permission checks. No confirmed exploitation, affected merchants or losses have been reported; the next step is to publish a version containing the fix and confirm that it has been deployed.
Source: Read the original article
Disclaimer: this content is for information purposes only and is not financial advice. Cryptocurrencies are highly volatile: you may lose all of your capital. Always do your own research. Legal notice
