Description
BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link, create-checkout-session, and products to open Stripe billing portals, view invoices, change payment methods, or alter subscriptions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
BoxyHQ saas-starter-kit
Default version status: unaffected
0 to ≤ 1.6.0affected
References
- https://github.com/boxyhq/saas-starter-kit/issues/2511 ↗
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pages/api/teams/%5Bslug%5D/payments/create-portal-link.ts ↗
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pages/api/teams/%5Bslug%5D/payments/create-checkout-session.ts ↗
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/pages/api/teams/%5Bslug%5D/payments/products.ts ↗
- https://github.com/boxyhq/saas-starter-kit/blob/v1.6.0/lib/permissions.ts ↗
- https://www.vulncheck.com/advisories/boxyhq-saas-starter-kit-through-1.6.0-missing-authorization-on-team-payment-api ↗