BTCPay’s API key fix is merged, but its latest release still predates the patch

BTCPay Server, software for accepting Bitcoin payments, merged a fix on Oct. 19 for a gap that could let API keys with broad permissions for one store reach server-wide or account-wide functions. For merchants sharing such credentials with an integration, the risk is delegating more authority than intended.Nicolas Dorier merged PR #7684 into the project's master development branch. As of Oct. 26, BTCPay's release list still identifies version 2.4.5, dated Oct. 6, as its latest release.How the permission boundary changesBTCPay's authentication documentation describes API keys as integration credentials restricted by permission and store. Those are separate limits: what an application may do, and which store it may act on.The added regression tests use keys with unrestricted permissions scoped to a single store: broad authority over actions, with a separate limit on where they apply. One asserts that an administrator-owned key must be denied access to server roles. Another asserts that an ordinary user's key must be denied deletion of that user's account.These examples involve broad store-scoped grants. They do not establish that an invoice-only key can obtain administrator powers. S...