CVE-2026-112293: Missing Authorization in BoxyHQ saas-starter-kit

CVE-2026-112293 describes a missing authorization vulnerability in BoxyHQ Enterprise SaaS Starter Kit through version 1.6.0. The flaw allows authenticated users with MEMBER or ADMIN roles, but who are not team owners, to bypass permission checks on payment routes. Specifically, these users can invoke API endpoints such as create-portal-link, create-checkout-session, and products to open Stripe billing portals and perform billing management actions including viewing invoices, changing payment methods, and altering subscriptions. This is due to the absence of enforcement of the team_payments permission on these routes.

The vulnerability enables unauthorized team members to manage billing information and subscription details, potentially leading to unauthorized changes in payment methods or subscription plans. While the vulnerability requires authenticated access with at least MEMBER privileges, it bypasses intended authorization controls, which could result in financial or operational impacts for affected organizations.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict team membership privileges carefully and monitor billing-related activities for unauthorized changes.