Skip to content
OpenAdvisories

Vendor

BoxyHQ

1 known vulnerabilities.

Products

saas-starter-kit 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.4
    CVE-2026-112293

    BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API

    BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or ADMIN users can call c…

    BoxyHQ saas-starter-kit