CVE-2026-63100

Name of the Vulnerable Software and Affected Versions Maybe versions prior to 0.6.0

Description Authenticated users with low-privilege member roles can access and modify global hosting settings. This occurs because the ensure admin filter is only applied to the clear cache action within the Settings::HostingsController, leaving the show and update actions unprotected. An attacker can exploit this to read the operator's Synth API key in plaintext, overwrite it with a custom value, toggle public registration settings, and disable email confirmation requirements.

Recommendations Update to version 0.6.0 or later. Restrict access to the Settings::HostingsController to prevent unauthorized users from accessing the show and update actions.