{"id":"CVE-2026-112293","kind":"vulnerability","aliases":["CVE-2026-112293"],"related":[],"title":"BoxyHQ SaaS Starter Kit: team members can manage billing without permission","description":"BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link, create-checkout-session, and products to open Stripe billing portals, view invoices, change payment methods, or alter subscriptions.","summary":"BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 has payment routes that skip the team_payments permission check. An authenticated member or admin who is not the team owner can open Stripe billing portals, view invoices, change payment methods, and alter subscriptions.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["boxyhq","other","saas-starter-kit","self-hosted","stripe"],"not_affected_if":["no-stripe-billing","permission-check-added"],"how_to_check":"- Check the starter kit version in the project's package.json or release tag: unknown if still on `1.6.0` or earlier.\n- Review the payment route handlers (create-portal-link, create-checkout-session, products) for a call to the team_payments permission check: unknown whether your fork has it.","fix":"- Upgrade the BoxyHQ Enterprise SaaS Starter Kit past `1.6.0`: unknown fixed version in the sources.\n- Until patched, add the team_payments permission check to the payment routes so only the billing role can call them.","status":"open","published_at":"2026-10-19T14:17:08+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:16:48+00:00","updated_at":"2026-10-25T04:16:48+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:16:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the BoxyHQ Enterprise SaaS Starter Kit past `1.6.0`: unknown fixed version in the sources.\n- Until patched, add the team_payments permission check to the payment routes so only the billing role can call them.","reach":"internet","title":"BoxyHQ SaaS Starter Kit: team members can manage billing without permission","impact":"medium","summary":"BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 has payment routes that skip the team_payments permission check. An authenticated member or admin who is not the team owner can open Stripe billing portals, view invoices, change payment methods, and alter subscriptions.","category":"other","nicknames":[],"who_cares":["boxyhq","saas-starter-kit","stripe","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Non-owner team members alter subscriptions and read billing data","analyst_note":"Find the fixed version and the upstream advisory for BoxyHQ SaaS Starter Kit; the NVD entry gives no patched release.","how_to_check":"- Check the starter kit version in the project's package.json or release tag: unknown if still on `1.6.0` or earlier.\n- Review the payment route handlers (create-portal-link, create-checkout-session, products) for a call to the team_payments permission check: unknown whether your fork has it.","needs_analyst":true,"not_affected_if":["no-stripe-billing","permission-check-added"],"who_is_affected":"Teams running the BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 with Stripe billing enabled are exposed, since any authenticated MEMBER or ADMIN can reach the payment routes. Deployments without Stripe billing, or that have added the permission check themselves, can likely skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000671,"input_tokens":3367,"output_tokens":669,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112293':14A,17A '-2026':13A,16A '1.6.0':34B,75C 'admin':49B,103C 'allow':82C 'alter':67B,128C 'authent':46B,100C 'author':79C 'bill':9A,59B,90C,120C 'boxyhq':1A,18B,28B,69C 'call':106C 'chang':63B,124C 'check':44B,99C 'checkout':113C 'contain':76C 'creat':108C,112C 'create-checkout-sess':111C 'create-portal-link':107C 'cve':12A,15A 'enterpris':29B,70C 'host':26B 'invoic':62B,123C 'kit':4A,23B,32B,73C 'link':110C 'manag':8A,89C 'member':6A,47B,87C,101C 'method':65B,126C 'miss':78C 'non':84C 'non-own':83C 'open':57B,118C 'owner':55B,85C 'payment':36B,42B,64B,92C,97C,125C 'permiss':11A,43B,98C 'portal':60B,109C,121C 'product':116C 'rout':37B,93C 'saa':2A,21B,30B,71C 'saas-starter-kit':20B 'self':25B 'self-host':24B 'session':114C 'skip':39B,94C 'starter':3A,22B,31B,72C 'stripe':27B,58B,119C 'subscript':68B,129C 'team':5A,41B,54B,86C,96C 'user':104C 'view':61B,122C 'vulner':80C 'without':10A","nicknames":[],"mitigations":[],"who_affected":"Teams running the BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 with Stripe billing enabled are exposed, since any authenticated MEMBER or ADMIN can reach the payment routes. Deployments without Stripe billing, or that have added the permission check themselves, can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112293","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112293","severity":null,"published_at":"2026-10-19T14:17:08+00:00","modified_at":"2026-10-22T03:16:37+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}