CVE-2026-112293 — BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API
BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip …
Published: 2026-10-19 · CVSS: 5.3 · CVSS 4.0
BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link, create-checkout-session, and products to open Stripe billing portals, view invoices, change payment methods, or alter subscriptions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7