BTCPAY SERVER FIXED STORE KEYS THAT REACHED SERVER-WIDE — THE FIX MERGED OCTOBER 19 — THE NEWEST RELEASE, V2.4.5, IS FROM OCTOBER 6

BTCPay Server merged a fix on October 19, 2026 for API keys that could do more than they were allowed. Pull request #7684, from maintainer Kukks, says: "A key limited to one store can no longer use server-wide permissions or account-wide user permissions merely because its owner is a server administrator. A restricted key also can no longer create a broader key for another user." Bitcoin Optech's newsletter #428, published October 23, called it "a privilege escalation."

The catch is the calendar. The fix went into the main branch at 13:56 UTC on October 19. The newest BTCPay release on GitHub, checked at 15:00 UTC on October 23, is v2.4.5, published October 6. A server running a release build still runs the old permission check, and the flaw is now written up in public.

BTCPay exists so a shop can take bitcoin without handing its keys to a payment company. That is self-custody for a merchant. An API key is a smaller key, handed to a plugin or an app to do one store's work. Its whole value is its limit. The pull request says the limit failed when the key's owner was a server admin, the account most likely to make keys and the one with the most reach.

Nobody else can close this for a self-hosted server. Until a release ships, the operator is the one who knows which keys exist, who made them, and what they can touch. At the time of this writing, bitcoin was $81,501.