A missing authorization check (CWE-862) in the BoxyHQ Enterprise SaaS Starter Kit allows authenticated users who are not the team owner to manipulate billing information. Members or administrators can create Stripe billing portals, view invoices, change payment methods, and modify subscriptions through the team payment API routes. This flaw permits non‑owner users to alter financial data and potentially incur unauthorized charges or service changes, resulting in significant financial losses or billing disputes.

Instance of BoxyHQ Enterprise SaaS Starter Kit, version 1.6.0, part of the BoxyHQ SaaS Starter Kit product line. Only this release is impacted; higher versions are not affected.

The CVSS score of 5.3 indicates a moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated MEMBER or ADMIN account within a team; once logged in, a user can call the create‑portal‑link, create‑checkout‑session, and products endpoints to perform billing actions. The lack of proper authorization checks thus provides an internal attack vector where legitimate users can benefit from the misconfigurations.