Missing authorization in the HostingsController enables authenticated users with a member role to read the operator's Synth API key, alter public registration settings, toggle email confirmation requirements, and overwrite the API key with an attacker‑controlled value. This flaw allows a low‑privileged user to modify global hosting settings and disrupt the entire application instance. The vulnerability stems from the absence of an authorization check on the show and update actions. The flaw directly compromises confidentiality by exposing a plaintext API key, integrity by permitting unauthorized configuration changes, and availability by enabling service disruption.

The product affected is the "maybe" application developed by maybe‑finance, version 0.6.0. No other product or vendor variants are listed. Users running this version should review their deployment to determine if the vulnerable controller is exposed.

The CVSS score of 7.1 classifies the flaw as high severity, yet the EPSS score of less than 1% indicates a very low probability of exploitation at the present time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers need authenticated access with a low privilege role, exploiting the missing authorization on show and update actions. Once accessed, the attacker can modify the global hosting settings without further authentication, but no remote code execution is possible from the information provided.