Executive brief
Maybe, a self-hosted personal finance application, contains a security flaw where regular users can access administrative hosting settings. An authorized user with low privileges can view sensitive API keys in plain text and change global system settings, such as disabling email verification or opening the platform to public registration. This could lead to unauthorized access to third-party services or disruption of the entire financial management instance.
Technical details
A missing authorization vulnerability (CWE-862) exists in the Settings::HostingsController of the Maybe application. The 'ensure_admin' before_action filter was incorrectly applied only to the 'clear_cache' action, leaving the 'show' and 'update' actions unprotected. An authenticated user with a 'member' role can exploit this to view the 'synth_api_key' in plaintext from the HTML source and perform unauthorized updates to global configuration settings like 'require_invite_for_signup' and 'require_email_confirmation'. This allows for credential theft and unauthorized modification of application-wide security policies. The product is currently archived and may not receive a formal patch.
Affected products
- Maybe Finance Maybe <= 0.6.0
Timeline
- 2026-07-17: advisory: Advisory published by VulnCheck and NVD