The password field special-case in this codebase is the tell. Someone encountered the WTForms checkbox-as-False problem before—browsers omit unchecked checkboxes from POST data, so a missing checkbox becomes False instead of 'no change.' They recognized the risk for the password field and added protection. Then they left every other checkbox in the settings form exposed to the exact same bypass.
This isn't a coding oversight. It's incomplete threat modeling. The developers knew the pattern, patched one instance, and didn't step back to ask whether the entire settings merge strategy was structurally flawed.
The vulnerable pattern is a blind .update() merge: the endpoint takes form data and applies it wholesale to the settings object. HTTP form submissions are partial updates by design—clients omit fields they don't want to change, and attackers omit fields they want to exploit. A minimal scripted request that simply omits a checkbox can flip api_access_token_enabled, webhooks_enabled, or any other boolean setting to False, regardless of the user's actual intent.
The fix matters enormously. Field-by-field special-casing (adding 'if api_access_token_enabled is not in form: preserve existing value') is fragile and will silently break whenever a developer adds a new checkbox without copying the pattern. The correct remediation is architectural: switch to a three-state model where omitted fields explicitly mean 'no change,' or use an allowlist that defines which fields are permitted to transition from True to False.
Check your codebase for other settings handlers using the same blind merge pattern. The password special-case may have been applied to one endpoint while legacy handlers, renamed routes, or deprecated API versions still use the vulnerable pattern. Audit handlers in api/v1/, legacy/, or any routes marked as superseded—these often don't receive the same security review as active endpoints and may lack the password-field protection entirely.