Live › vulnerability › CVE-2026-112293
Go to dashboardBoxyHQ Enterprise SaaS Starter Kit through 1.6.0 has payment routes that skip the team_payments permission check. An authenticated member or admin who is not the team owner can open Stripe billing portals, view invoices, change payment methods, and alter subscriptions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 with Stripe billing enabled are exposed, since any authenticated MEMBER or ADMIN can reach the payment routes. Deployments without Stripe billing, or that have added the permission check themselves, can likely skip it.
No product ranges from the sources yet.
1.6.0 or earlier.1.6.0: unknown fixed version in the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link, create-checkout-session, and products to open Stripe billing portals, view invoices, change payment methods, or alter subscriptions.
This page as .md · .json · in your agent: get_signal("CVE-2026-112293")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.