Threats affecting pkg:npm/next-saas-stripe-starter

CVE-2026-4548 is a medium severity vulnerability in mickasmt next-saas-stripe-starter version 1.0.0, specifically in the updateUserrole function of actions/update-user-role.ts. The flaw allows improper authorization due to manipulation of userId and role parameters, enabling an attacker to potentially escalate privileges or modify user roles without proper permission. The vulnerability can be exploited remotely without user interaction and requires low privileges, making it accessible to authenticated attackers with minimal barriers. Although no known exploits are currently reported in the wild, the risk of unauthorized role changes could lead to privilege escalation and unauthorized access to sensitive functions. Organizations using this starter kit for SaaS applications integrating Stripe should prioritize patching or implementing strict access controls. Countries with significant SaaS development ecosystems and Stripe usage are at higher risk. Mitigation involves enforcing strict authorization checks on role updates, validating input parameters, and monitoring role change activities.