CVE-2026-63100: Maybe 0.6.0 Missing Authorization via HostingsController show/update
Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-privilege member-role users to access and modify global hosting settings by exploiting unprotected show and update actions in the Settings::HostingsController, where the beforeaction ensureadmin filter is applied only to the clearcache action. Attackers can read the operator's Synth API key rendered in plaintext via a form field value attribute, overwrite it with an attacker-controlled value, toggle public registration settings, and disable email confirmation requirements to disrupt the entire instance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.6.0Patch Missing Authorization via HostingsController show/update - Compensating control
Restrict access to Settings::HostingsController show and update actions so only authorized admins can reach/execute them (the text notes ensure_admin before_action is applied only to clear_cache, implying show/update lack that protection in v0.6.0).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63100?
CVE-2026-63100 has a medium severity rating of 6.5.
How do I fix CVE-2026-63100?
To fix CVE-2026-63100, ensure that the before_action filter in Settings::HostingsController properly restricts access to only authorized users.
Who is affected by CVE-2026-63100?
Authenticated low-privilege member-role users are affected by CVE-2026-63100.
What actions are vulnerable in CVE-2026-63100?
The show and update actions in the Settings::HostingsController are vulnerable in CVE-2026-63100.
Which software versions are impacted by CVE-2026-63100?
CVE-2026-63100 affects Maybe through version 0.6.0.