Fix: CanModifyInvoices permission should include the ability to see the lightning invoices of the store
What the developer wrote
Authored by Nicolas Dorier
Fix: CanModifyInvoices permission should include the ability to see the lightning invoices of the store
What changed, and why it matters
This commit fixes a permission inconsistency in BTCPay Server. Previously, a user who had permission to create Lightning invoices for a store might not have had explicit permission to view those same Lightning invoices. The change makes 'view Lightning invoice' a child permission of 'create Lightning invoice', so anyone who can create them can also see them. This is described as a fix, not a new security vulnerability disclosure, and the diff alone does not show an active exploit or a disclosed incident.
Review whether any role or API key previously granted only CanCreateLightningInvoiceInStore now gains unintended read access, and verify that this aligns with the intended CanModifyInvoices workflow. Consider whether the change should be accompanied by a changelog or security note if it alters effective permissions for existing users.
Security signals we found
Permission hierarchy correction
Lightning invoice visibility policy change
No explicit security advisory or CVE in commit
No proof-of-concept or exploit code present
Evidence from the diff
In BTCPayServer.Client/Permissions.cs, a single line is added to the policy hierarchy: PolicyHasChild(policyMap, Policies.CanCreateLightningInvoiceInStore, Policies.CanViewLightningInvoiceInStore). This establishes that CanCreateLightningInvoiceInStore implies CanViewLightningInvoiceInStore. The commit title frames this as a fix for CanModifyInvoices implicitly needing Lightning invoice visibility. The change is a one-line permission inheritance correction; no CVE, advisory, researcher credit, or incident details are present in the supplied materials.
Changed components
BTCPayServer.Client/Permissions.csCanCreateLightningInvoiceInStore permissionCanViewLightningInvoiceInStore permissionLightning invoice store access controlInspect captured patch +1 / −0
diff --git a/BTCPayServer.Client/Permissions.cs b/BTCPayServer.Client/Permissions.cs
index b24ec37..640900a 100644
--- a/BTCPayServer.Client/Permissions.cs
+++ b/BTCPayServer.Client/Permissions.cs
@@ -280,6 +280,7 @@ namespace BTCPayServer.Client
PolicyHasChild(policyMap,Policies.CanModifyProfile, Policies.CanViewProfile);
PolicyHasChild(policyMap,Policies.CanModifyOfferings, Policies.CanViewOfferings, Policies.CanManageSubscribers, Policies.CanCreditSubscribers);
PolicyHasChild(policyMap,Policies.CanUseLightningNodeInStore, Policies.CanViewLightningInvoiceInStore, Policies.CanCreateLightningInvoiceInStore);
+ PolicyHasChild(policyMap,Policies.CanCreateLightningInvoiceInStore, Policies.CanViewLightningInvoiceInStore);
PolicyHasChild(policyMap,Policies.CanManageNotificationsForUser, Policies.CanViewNotificationsForUser);
PolicyHasChild(policyMap,Policies.CanModifyServerSettings,
Policies.CanUseInternalLightningNode,
Why this scored 50/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.