Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H N N 7.1 .0021 11.3 —
AFFECTED Product Versions Fixed maybe unspecified —
TIMELINE Jul 15 Reserved by VulnCheck Jul 17 EXPLOIT PUBLISHED — CVE-2026-63100 (maybe-finance maybe). Public exploit reference added. Jul 17 Published (CNA: VulnCheck)
Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-privilege member-role users to access and modify global hosting settings by exploiting unprotected show and update actions in the Settings::HostingsController, where the before_action ensure_admin filter is applied only to the clear_cache action. Attackers can read the operator's Synth API key rendered in plaintext via a form field value attribute, overwrite it with an attacker-controlled value, toggle public registration settings, and disable email confirmation requirements to disrupt the entire instance.
| Date | Event | Detail |
|---|---|---|
| July 15, 2026 | Reserved | Reserved by VulnCheck |
| July 17, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-63100 (maybe-finance maybe). Public exploit reference added. |
| July 17, 2026 | Published | Published (CNA: VulnCheck) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| maybe-finance | maybe | — | — | — |
Authoritative record: CVE-2026-63100 at cve.org
Vendors: maybe-finance
Weaknesses: CWE-862
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-63100 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.