BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link, create-checkout-session, and products to open Stripe billing portals, view invoices, change payment methods, or alter subscriptions.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 2
- StatusReceived → DeferredNVD modified 2026-10-19 21:14
- First seenCVSS 5.3NVD modified 2026-10-19 14:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 6
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/lib/permissions.ts
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pages/api/teams/%5Bslug%5D/payments/create-checkout-session.ts
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pages/api/teams/%5Bslug%5D/payments/create-portal-link.ts
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pages/api/teams/%5Bslug%5D/payments/products.ts
- https://github.com/boxyhq/saas-starter-kit/issues/2511
- https://www.vulncheck.com/advisories/boxyhq-saas-starter-kit-through-1.6.0-missing-authorization-on-team-payment-api