CVE-2026-112293
CVE-2026-112293 · BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link, create-checkout-session, and products to open Stripe billing portals, view invoices, change payment methods, or alter subscriptions.
CVSS 5.3 · Media · EPSS 0,2%
- Publicación
- Actualización
Productos y versiones afectados
saas-starter-kit
- Versiones
- ≥ 0, ≤ 1.6.0: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/boxyhq/saas-starter-kit/issues/2511
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pages/api/teams/%5Bslug%5D/payments/create-portal-link.ts
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pages/api/teams/%5Bslug%5D/payments/create-checkout-session.ts
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pages/api/teams/%5Bslug%5D/payments/products.ts
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/lib/permissions.ts
- https://www.vulncheck.com/advisories/boxyhq-saas-starter-kit-through-1.6.0-missing-authorization-on-team-payment-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-112293