The flaw lies in the updateUserrole function of mickasmt next-saas-stripe-starter, where manipulating the userId and role inputs bypasses the intended authorization checks. This results in an improper privilege escalation that can grant an attacker any role, potentially providing full control over the application. The weakness corresponds to CWE‑266 (Improper Privilege Management) and CWE‑285 (Improper Authorization), indicating that the system fails to enforce correct role boundaries.

The vulnerable software is v1.0.0 of the open‑source project mickasmt next‑saas‑stripe‑starter. No other versions are listed as affected in the current advisory.

The CVSS base score of 5.3 indicates moderate severity. EPSS data is unavailable and the vulnerability is not yet in the CISA Known Exploited Vulnerabilities catalog. The description notes that the attack can be launched remotely, implying that the updateUserrole endpoint is exposed to network traffic. An attacker who can reach this endpoint can craft userId and role values to change any user’s role, which may compromise confidentiality, integrity, and availability of the application. While the likelihood of exploitation is uncertain, the impact warrants prompt mitigation.