SEPTEMBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-63100

MEDIUM · CVSS 6.5 EPSS 0.21% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-17 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

Authenticated low-privilege users can exploit a missing authorization vulnerability to access and modify global hosting settings, bypassing security controls meant to restrict such actions. This could lead to unauthorized changes, including exposure of sensitive API keys and disruption of instance operations, such as altering registration settings and disabling email confirmations. Organizations using affected versions should prioritize remediation to protect against potential exploitation and maintain the integrity of their systems.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit
GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-63100
Severity
MEDIUM
CVSS
6.5
EPSS
0.21%

Original NVD Description

Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-privilege member-role users to access and modify global hosting settings by exploiting unprotected show and update actions in the Settings::HostingsController, where the before_action ensure_admin filter is applied only to the clear_cache action. Attackers can read the operator's Synth API key rendered in plaintext via a form field value attribute, overwrite it with an attacker-controlled value, toggle public registration settings, and disable email confirmation requirements to disrupt the entire instance.