BTCPay Server merged an API key vulnerability fix on October 19, but its latest public release (v2.4.5, Oct 6) still predates the patch as of October 26. The fix addresses a gap that could allow API keys with broad permissions for one store to access server-wide or account-wide functions, potentially delegating more authority than intended. The patch restricts broad store-scoped grants from satisfying server-wide or account-wide checks and adds a check on requested permissions during key creation. No confirmed exploitation or losses have been reported.