Threat Intelligence Database

A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-portal.ts of the component Stripe API. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult.

LowVulnerabilityUnited StatesCanadaUnited Kingdom+7#cve#cve-2026-4549

CVE-2026-4548 is a medium severity vulnerability in mickasmt next-saas-stripe-starter version 1.0.0, specifically in the updateUserrole function of actions/update-user-role.ts. The flaw allows improper authorization due to manipulation of userId and role parameters, enabling an attacker to potentially escalate privileges or modify user roles without proper permission. The vulnerability can be exploited remotely without user interaction and requires low privileges, making it accessible to authenticated attackers with minimal barriers. Although no known exploits are currently reported in the wild, the risk of unauthorized role changes could lead to privilege escalation and unauthorized access to sensitive functions. Organizations using this starter kit for SaaS applications integrating Stripe should prioritize patching or implementing strict access controls. Countries with significant SaaS development ecosystems and Stripe usage are at higher risk. Mitigation involves enforcing strict authorization checks on role updates, validating input parameters, and monitoring role change activities.

MediumVulnerabilityUnited StatesCanadaUnited Kingdom+7#cve#cve-2026-4548