BoxyHQ Enterprise SaaS Starter Kit CVE-2026-112293

Requires a valid authenticated account on the target team with the MEMBER or ADMIN role (PR:L); team-owner privileges are NOT needed because the create-portal-link, create-checkout-session, and products payment API routes under /api/teams/[slug]/payments/ omit the team_payments permission check. Exploitation is limited to teams that use the built-in Stripe billing integration and have granted team access to users who should not control billing; no user interaction, no non-default configuration beyond enabling payments, and no special platform is required. The practical limiting factor is that the attacker must already be a provisioned, non-owner member of the specific team whose billing they target.

This is a genuine but moderate-severity access-control flaw, not a high-urgency emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 Medium score are internally consistent with the description: an attacker needs valid, authenticated team credentials (PR:L - a MEMBER or ADMIN account), so this is NOT remote-unauthenticated. Impact is limited (VC:L/VI:L/VA:N, no subsequent-system impact) because the attacker can only read billing/invoice data and manipulate the team's Stripe subscription/payment configuration - there is no code execution, no broad data breach, and no availability impact. No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input; per the data, there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic risk is an insider or compromised low-privilege team account abusing billing functions (e.g., changing payment methods or cancelling/altering subscriptions), which is a business/financial and integrity concern rather than a classic infrastructure compromise. Priority should be driven by whether an organization runs this starter kit in production with untrusted MEMBER/ADMIN users; for most, this is a patch-in-normal-cycle issue, not a drop-everything one.

A user who was invited to a team only as a MEMBER (or a non-owner ADMIN) authenticates normally, then directly calls the team's payment API endpoints (create-portal-link, create-checkout-session, or products), which fail to enforce the team_payments permission. The attacker is handed a Stripe billing portal session where they can view invoices, swap the payment method, or alter the subscription despite never being the team owner. No public exploit code was identified at time of analysis, but exploitation requires only a standard authenticated HTTP request to a known route, so weaponization is trivial for any existing team member.