CVE-2026-112293
Received Received - Intake

BoxyHQ Enterprise SaaS Starter Kit Missing Authorization in Billing

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link, create-checkout-session, and products to open Stripe billing portals, view invoices, change payment methods, or alter subscriptions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112293
EUVD
EUVD-2026-104280

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
BoxyHQ saas-starter-kit 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 has a missing authorization vulnerability. Non-owner team members with MEMBER or ADMIN roles can manage billing due to payment routes bypassing the team_payments permission check. This allows them to access Stripe billing portals, view invoices, change payment methods, or alter subscriptions.

Detection Guidance

To detect this vulnerability, inspect API endpoints for missing RBAC checks on payment routes. Verify if POST /api/teams/[slug]/payments/create-checkout-session, POST /api/teams/[slug]/payments/create-portal-link, and GET /api/teams/[slug]/payments/products skip team_payments permission validation. Test with MEMBER or ADMIN roles to confirm unauthorized access to billing functions.

Impact Analysis

An authenticated user with MEMBER or ADMIN privileges could exploit this to modify billing details, access sensitive payment information, or change subscription plans without proper authorization. This could lead to financial loss, unauthorized access to invoices, or disruption of services.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized users to access or modify sensitive financial or personal data. GDPR may be impacted due to unauthorized access to payment details, while HIPAA could be affected if protected health information is involved in billing data.

Mitigation Strategies

Upgrade BoxyHQ Enterprise SaaS Starter Kit to a version later than 1.6.0 where the authorization checks are properly enforced. Review and restrict permissions for MEMBER and ADMIN roles to ensure they cannot access billing-related functions without explicit owner privileges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112293. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart