saas-starter-kit vulnerabilities

CVEs whose affected-version data names the saas-starter-kit package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-112293Medium· 5.4

today

BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or …

▾ SunlitBoxyHQ · saas-starter-kitvia CVEORG