CVE-2026-4549

mickasmt next-saas-stripe-starter Stripe API open-customer-portal.ts openCustomerPortal authorization

View on CVE.org
Published Mar 22, 2026 CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Description
A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-portal.ts of the component Stripe API. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult.

Analysis

AI-generated

Technical impact

The flaw in the openCustomerPortal function of the Stripe API component within mickasmt next‑saas‑stripe‑starter 1.0.0 allows an attacker to bypass authorization checks and gain unauthorized access to the customer portal. This violation of access control could lead to viewing or modifying sensitive customer data, compromising confidentiality and integrity. The weakness is classified as an authorization bypass (CWE‑285) and privilege escalation (CWE‑639).

Affected Systems

Affected is the mickasmt next‑saas‑stripe‑starter application, version 1.0.0, which includes the file actions/open‑customer‑portal.ts in the Stripe API component. No other products or versions are listed as vulnerable.

Risk and Exploitability

The base score of 2.3 signals a low overall severity, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires high complexity and is known to be difficult, reducing the likelihood of an attack. Nevertheless, because remote exploitation is possible, an adversary who succeeds could obtain unauthorized access to customer information, posing a serious confidentiality and integrity risk.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade mickasmt next‑saas‑stripe‑starter to a patched version as soon as it becomes available.
  • If a patch is not yet released, block or restrict access to the Open Customer Portal endpoint until remediation is complete.
  • Enable logging and monitoring for all access attempts to the openCustomerPortal function to detect anomalous activity.
  • Review and enforce role‑based access controls to ensure only authorized users can invoke the function.

Generated by OpenCVE AI on March 22, 2026 at 16:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Mickasmt
Mickasmt next-saas-stripe-starter
Vendors & Products Mickasmt
Mickasmt next-saas-stripe-starter
Type Values Removed Values Added
Description A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-portal.ts of the component Stripe API. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult.
Title mickasmt next-saas-stripe-starter Stripe API open-customer-portal.ts openCustomerPortal authorization
Weaknesses CWE-285
CWE-639
References
Metrics cvssV2_0

{'score': 2.1, 'vector': 'AV:N/AC:H/Au:S/C:P/I:N/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.1, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-285

    Improper Authorization

  • CWE-639

    Authorization Bypass Through User-Controlled Key

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Mar 25, 2026, 1:45 PM
Reserved
Mar 21, 2026, 4:49 PM

View source JSON

Updated
Mar 25, 2026, 1:45 PM

JSON

Status
Deferred
Published
Mar 22, 2026, 2:16 PM
Modified
Jun 17, 2026, 10:56 AM

View source JSON

No data.

Updated
Mar 25, 2026, 2:50 PM

JSON