CVE-2026-112293 Details

A missing authorization vulnerability has been identified in BoxyHQ Enterprise SaaS Starter Kit versions through 1.6.0. This vulnerability allows non-owner team members to manage billing, as the payment routes bypass the necessary team_payments permission check. Authenticated MEMBER or ADMIN users can exploit this to create Stripe checkout sessions, generate billing portal links, and access product and subscription information. The issue arises because the payment API endpoints do not enforce role-based access control (RBAC) permissions, unlike other team-scoped endpoints.

The vulnerability can be addressed by adding the appropriate RBAC authorization checks to the payment API endpoints, ensuring that only authorized users can access these billing management functions.