PT-2026-27011 · Mickasmt · Next-Saas-Stripe-Starter

Ghufran Khan + 1 · Published 2026-03-22 · Updated 2026-03-22 · CVE-2026-4549

NVD

CVSS v2.0

2.1

Low

AV:N/AC:H/Au:S/C:P/I:N/A:N

A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-portal.ts of the component Stripe API. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult.

Fix

Improper Authorization

IDOR

Weakness Enumeration

CWE-285

CWE-639

Related Identifiers

CVE-2026-4549

Affected Products

Next-Saas-Stripe-Starter

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-4549 · Security Note
• https://vuldb.com/?id.352376 · Note
• https://vuldb.com/?submit.774806 · Note
• https://vuldb.com/?ctiid.352376 · Note