CVE-2026-4547 Details
Description
A security vulnerability has been detected in mickasmt next-saas-stripe-starter 1.0.0. Affected is the function generateUserStripe of the file actions/generate-user-stripe.ts of the component Checkout Handler. The manipulation of the argument priceId leads to business logic errors. The attack may be initiated remotely.
A business logic error vulnerability has been identified in mickasmt next-saas-stripe-starter version 1.0.0. The issue arises in the Checkout Handler component, specifically within the generateUserStripe function in actions/generate-user-stripe.ts. The vulnerability allows for arbitrary manipulation of the priceId parameter, which is sent to stripe.checkout.sessions.create without proper validation. This flaw could be exploited remotely, leading to unauthorized changes in subscription pricing.
Implement validation for the priceId parameter by checking it against a whitelist of known plan IDs before processing the checkout session. This can be done by referencing the application's subscription pricing data.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 22, 2026CISA-ADP
Assessed Mar 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/?ctiid.352374 | [email protected] | Content Wall |
| https://vuldb.com/?id.352374 | [email protected] | AdvisoryPartial Content |
| https://vuldb.com/?submit.774804 | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-840 | Business Logic Errors | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mickasmt next-saas-stripe-starter | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 22, 2026 | New CVE Received | [email protected] |