CVE-2026-72535
Received Received - Intake

Authentication Bypass in Chaskiq via Stripe Portal

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account. An attacker can access and manage subscription data for any tenant without credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72535
EUVD
EUVD-2026-56005

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
chaskiq chaskiq *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authentication issue in Chaskiq where unauthenticated remote attackers can create Stripe Billing Portal sessions for any tenant using the stripeCustomerPortal GraphQL mutation. The mutation lacks authentication or authorization checks, allowing attackers to access and manage subscription data for any tenant without credentials.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive subscription and billing data for any tenant. This could lead to data breaches, financial fraud, or unauthorized modifications to subscription plans, potentially disrupting services or causing financial losses.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires strict access controls and data protection, while HIPAA mandates safeguards for protected health information. Exploitation could result in violations and associated penalties.

Mitigation Strategies

Immediately update Chaskiq to the latest version that patches this vulnerability. Disable the stripeCustomerPortal GraphQL mutation if not required. Implement strict authentication and authorization checks for all GraphQL mutations. Review and restrict access to Stripe Billing Portal integrations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72535. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart