BoxyHQ

Records1All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

BoxyHQ records in CISA KEV

No BoxyHQ vulnerabilities are listed in CISA KEV.

Records

1 record

TI-2026-76493 CVE-2026-112293 · GHSA-c4x3-mrrr-qp35

BoxyHQ SaaS Starter Kit Missing Authorization on Team Payment API

LOW 23

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00184 Published 2026-10-19 No fix listed CWE-862

Open these records in search →

Critical	0
High	0
Medium	1
Low	0
No CVSS	0