The vulnerability in maybe-finance's maybe product (versions up to and including 0.6.0) arises from missing authorization checks on the show and update actions within the Settings::HostingsController. The before_action filter ensure_admin is improperly applied only to the clear_cache action, leaving other sensitive actions unprotected. As a result, authenticated users with low-privilege member roles can read the operator's Synth API key in plaintext from a form field, overwrite it with attacker-controlled values, and manipulate critical global hosting settings such as public registration and email confirmation requirements. This can lead to significant disruption of the instance's operation.

Authenticated low-privilege users can escalate their capabilities to access and modify global hosting settings, including reading and changing the operator's Synth API key, toggling public registration, and disabling email confirmation requirements. This compromises the confidentiality of sensitive credentials and the integrity of hosting configurations, potentially disrupting the entire instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users with member roles and monitor for unauthorized changes to hosting settings. Apply additional access controls or workarounds as recommended by the vendor once available.