CVE-2026-112293
CVE-2026-112293 · BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API
This page contains facts from public vulnerability sources. Check the original advisory before updating.
BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link, create-checkout-session, and products to open Stripe billing portals, view invoices, change payment methods, or alter subscriptions.
CVSS 5.3 · Medium · EPSS 0.2%
- Published
- Updated
Affected products and versions
saas-starter-kit
- Versions
- ≥ 0, ≤ 1.6.0: Affected (semver)
No fix published
Original sources
- https://github.com/boxyhq/saas-starter-kit/issues/2511
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pages/api/teams/%5Bslug%5D/payments/create-portal-link.ts
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pages/api/teams/%5Bslug%5D/payments/create-checkout-session.ts
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pages/api/teams/%5Bslug%5D/payments/products.ts
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/lib/permissions.ts
- https://www.vulncheck.com/advisories/boxyhq-saas-starter-kit-through-1.6.0-missing-authorization-on-team-payment-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-112293