CVE-2026-112293— BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API
Quick assessment
Affected
BoxyHQ saas-starter-kit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
BoxyHQ Enterprise SaaS Starter Kit 1.6.0 及以下版本存在一个缺少权限验证的漏洞。由于支付相关路由跳过了 权限检查，非团队所有者的团队成员可管理账单。已认证的 MEMBER（成员）或 ADMIN（管理员）用户可以调用 、 和 接口，从而打开 Stripe 账单门户、查看发票、更改支付方式或修改订阅信息。
Possible ATT&CK Techniques 2 AI
T1548 · Abuse Elevation Control Mechanism T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-112293
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API
Source: CVE Program / CVE List V5
Vulnerability Description
BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link, create-checkout-session, and products to open Stripe billing portals, view invoices, change payment methods, or alter subscriptions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| BoxyHQ | saas-starter-kit | 0 ~ 1.6.0 | - |
|
II. Public POCs for CVE-2026-112293
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-112293
请登录查看更多情报信息。
Other References for CVE-2026-112293 (6)
-
https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/lib/permissions.ts technical-description
-
https://github.com/boxyhq/saas-starter-kit/issues/2511 issue-tracking
IV. Related Vulnerabilities
Same weakness: CWE-862
-
CVE-2025-7043
Refresh Token Misuse via Validation Flaw in Multiple WSO2 Pr -
CVE-2026-111058
Mercury: Unauthenticated Remote Code Execution via /api/kern -
CVE-2026-111046
FOSSBilling: Low-privileged staff can read and modify config -
CVE-2026-107566
Missing Authorization in hMailServer -
CVE-2026-107568
Missing Authorization in hMailServer
V. Comments for CVE-2026-112293
No comments yet