The flaw in the openCustomerPortal function of the Stripe API component within mickasmt next‑saas‑stripe‑starter 1.0.0 allows an attacker to bypass authorization checks and gain unauthorized access to the customer portal. This violation of access control could lead to viewing or modifying sensitive customer data, compromising confidentiality and integrity. The weakness is classified as an authorization bypass (CWE‑285) and privilege escalation (CWE‑639).

Affected is the mickasmt next‑saas‑stripe‑starter application, version 1.0.0, which includes the file actions/open‑customer‑portal.ts in the Stripe API component. No other products or versions are listed as vulnerable.

The base score of 2.3 signals a low overall severity, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires high complexity and is known to be difficult, reducing the likelihood of an attack. Nevertheless, because remote exploitation is possible, an adversary who succeeds could obtain unauthorized access to customer information, posing a serious confidentiality and integrity risk.