Missing Authorization Flaw in BoxyHQ Enterprise SaaS Starter Kit
CVE-2026-112293

5.3MEDIUM

Key Information:

Vendor

Boxyhq

Status
Saas-starter-kit
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112293?

The BoxyHQ Enterprise SaaS Starter Kit version 1.6.0 has a vulnerability related to missing authorization checks, enabling authenticated non-owner team members to manage billing functionalities. This oversight allows users with MEMBER or ADMIN roles to access and manipulate sensitive billing operations, including creating and managing Stripe billing portals, viewing invoices, modifying payment methods, and adjusting subscriptions without proper permissions. This flaw compromises the integrity of financial transactions within the application, posing a risk to team financial security.

Affected Version(s)

saas-starter-kit 0 <= 1.6.0

References

https://github.com/boxyhq/saas-starter-kit/issues/2511
issue-tracking
https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pa...
technical-description
https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pa...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212
leediay153 from Viettel Post
.