Which versions of Maybe Finance are affected by CVE-2026-63100?

Maybe Finance self-hosted instances (version 0.6.0 and prior) contain a broken access control vulnerability with publicly available exploit code that permits authenticated low-privilege users to…

Is there a public PoC exploit available for CVE-2026-63100?

Yes, a public proof-of-concept exploit is available for CVE-2026-63100. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-63100?

Within 24 hours: immediately restrict or revoke access for member-role accounts in all affected Maybe Finance instances and rotate the operator's Synth API key to invalidate any exfiltrated credentials. Within 7 days: monitor vendor communications for a patched release of Maybe Finance; implement network-level access controls to block member-role users from accessing Settings::HostingsController and enable detailed audit logging of all settings modifications. Within 30 days: deploy the vendor-released patch to Maybe Finance upon availability, or migrate to an alternative personal finance platform if remediation timelines exceed organizational risk tolerance.

Maybe Finance CVE-2026-63100

Q: What is the CVSS score of CVE-2026-63100?

CVE-2026-63100 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45199 HIGH

Missing Authorization (CWE-862)

2026-07-17 VulnCheck

GHSA-xhqm-9834-m8hg

Authentication Bypass Maybe

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Any authenticated low-priv member exploits an unprotected action over the network (PR:L, AC:L, UI:N); reading the API key gives C:H and rewriting global settings gives I:H, with no direct availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 16:17 vuln.today

CVE Published

Jul 17, 2026 - 15:45 cve.org

HIGH 7.1

DescriptionCVE.org

Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-privilege member-role users to access and modify global hosting settings by exploiting unprotected show and update actions in the Settings::HostingsController, where the before_action ensure_admin filter is applied only to the clear_cache action. Attackers can read the operator's Synth API key rendered in plaintext via a form field value attribute, overwrite it with an attacker-controlled value, toggle public registration settings, and disable email confirmation requirements to disrupt the entire instance.

AnalysisAI

Broken access control in Maybe Finance (self-hosted personal finance app) through 0.6.0 lets any authenticated low-privilege member-role user read and rewrite instance-wide hosting settings because Settings::HostingsController applies the ensure_admin before_action only to clear_cache, leaving show and update exposed. A member can exfiltrate the operator's Synth API key rendered in plaintext in a form field, replace it with an attacker-controlled value, enable open public registration, and disable email-confirmation enforcement to disrupt the instance. Publicly available exploit code exists (reported by VulnCheck); this is not listed in CISA KEV, so there is no public exploit identified beyond the released POC.

Technical ContextAI

Maybe Finance is a Ruby on Rails open-source self-hosted personal-finance/budgeting application (CPE cpe:2.3:a:maybe-finance:maybe). The flaw is a classic CWE-862 Missing Authorization: Rails controllers gate privileged actions with before_action filters, but here ensure_admin is registered only for the clear_cache action rather than for the whole controller or for the sensitive show/update actions. Consequently the intended admin-only Settings::HostingsController#show and #update endpoints inherit only ordinary authenticated-session enforcement, not the role check. The show view renders the operator's Synth market-data API key directly into an HTML input value attribute, so the secret is disclosed to anyone who can reach the page, while the update action accepts arbitrary changes to global registration and email-confirmation policy.

RemediationAI

No vendor-released patch version is identified in the available data, so track the advisories for current fix status: VulnCheck (https://www.vulncheck.com/advisories/maybe-missing-authorization-via-hostingscontroller-show-update) and the write-up (https://github.com/geo-chen/oss/blob/main/maybe.md); upgrade to a fixed release as soon as maintainers publish one that moves ensure_admin to a controller-wide before_action covering show and update. As immediate compensating controls, restrict the Settings::Hostings show/update routes to admins at the reverse proxy or Rails routing layer, disable public registration so untrusted member accounts cannot self-provision (trade-off: legitimate self-service signup is lost), and rotate the Synth API key on the assumption it has already been disclosed. Because a member could have overwritten the key or altered email-confirmation policy, audit hosting settings for tampering and re-enable email confirmation after patching; note that locking these routes at the proxy may also block the legitimate admin UI unless the admin path is explicitly allowed.