CVE-2026-112293: BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API
BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link, create-checkout-session, and products to open Stripe billing portals, view invoices, change payment methods, or alter subscriptions.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit the missing authorization check?
Any authenticated team member with the MEMBER or ADMIN role can invoke the affected payment endpoints. The user does not need to be the team owner or hold the team_payments permission.
What billing actions can an unauthorized team member perform?
They can call the create-portal-link, create-checkout-session, and products payment routes. This can expose invoices and allow changes to payment methods or subscriptions through the Stripe billing portal.
Are unauthenticated attackers affected by this issue?
No. Exploitation requires an authenticated account that is a MEMBER or ADMIN of the targeted team.
What versions are identified as affected?
BoxyHQ SaaS Starter Kit through version 1.6.0 is identified as affected.