Threats Tagged 'cve-2026-4548'
View all threats tagged with 'cve-2026-4548'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-4548'
Click on any threat for detailed analysis and mitigation recommendations
CVE-2026-4548 is a medium severity vulnerability in mickasmt next-saas-stripe-starter version 1.0.0, specifically in the updateUserrole function of actions/update-user-role.ts. The flaw allows improper authorization due to manipulation of userId and role parameters, enabling an attacker to potentially escalate privileges or modify user roles without proper permission. The vulnerability can be exploited remotely without user interaction and requires low privileges, making it accessible to authenticated attackers with minimal barriers. Although no known exploits are currently reported in the wild, the risk of unauthorized role changes could lead to privilege escalation and unauthorized access to sensitive functions. Organizations using this starter kit for SaaS applications integrating Stripe should prioritize patching or implementing strict access controls. Countries with significant SaaS development ecosystems and Stripe usage are at higher risk. Mitigation involves enforcing strict authorization checks on role updates, validating input parameters, and monitoring role change activities. Join the discussion | CVE Database V5 | 03/22/2026, 13:02:44 UTC Added: 03/22/2026, 13:30:51 UTC |
Showing 1 to 1 of 1 result