CVE-2026-112293
CVE-2026-112293 · BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link, create-checkout-session, and products to open Stripe billing portals, view invoices, change payment methods, or alter subscriptions.
CVSS 5.3 · Mittel · EPSS 0,2%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
saas-starter-kit
- Softwareversionen
- ≥ 0, ≤ 1.6.0: Betroffen (semver)
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/boxyhq/saas-starter-kit/issues/2511
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pages/api/teams/%5Bslug%5D/payments/create-portal-link.ts
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pages/api/teams/%5Bslug%5D/payments/create-checkout-session.ts
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pages/api/teams/%5Bslug%5D/payments/products.ts
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/lib/permissions.ts
- https://www.vulncheck.com/advisories/boxyhq-saas-starter-kit-through-1.6.0-missing-authorization-on-team-payment-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-112293