CVE-2026-4548 - mickasmt next-saas-stripe-starter update-user-role.ts updateUserrole improper authorization

Back Back to CVE browser

MEDIUM

mickasmt next-saas-stripe-starter update-user-role.ts updateUserrole improper authorization

Published Mar 22, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.34%

Description

A vulnerability was detected in mickasmt next-saas-stripe-starter 1.0.0. Affected by this vulnerability is the function updateUserrole of the file actions/update-user-role.ts. The manipulation of the argument userId/role results in improper authorization. The attack may be launched remotely.

Affected products

Vendor Mickasmt Product Next-Saas-Stripe-Starter Default
n/a
- Version
  1.0.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mickasmt

Next-Saas-Stripe-Starter

n/a

Version	Status	Constraints
1.0.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-266

Incorrect Privilege Assignment

CWE-285

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14306
Advisory
https://vuldb.com/?ctiid.352375
signaturepermissions-required
https://vuldb.com/?id.352375
vdb-entrytechnical-description
https://vuldb.com/?submit.774805
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14306		Advisory
https://vuldb.com/?ctiid.352375		signaturepermissions-required
https://vuldb.com/?id.352375		vdb-entrytechnical-description
https://vuldb.com/?submit.774805		third-party-advisory