CVE-2026-72535

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account. An attacker can access and manage subscription data for any tenant without credentials.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/chaskiq/chaskiq

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de autenticación faltante en Chaskiq a través del commit 46dfdd1 permite a atacantes remotos no autenticados generar sesiones del Portal de Facturación de Stripe para cualquier inquilino a través de la mutación GraphQL stripeCustomerPortal. La mutación no realiza comprobaciones de autenticación ni de autorización antes de crear una sesión del portal del cliente vinculada a cualquier cuenta de Stripe de inquilino. Un atacante puede acceder y gestionar datos de suscripción para cualquier inquilino sin credenciales.

Information

Published : 2026-08-11 12:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-72535

Mitre link : CVE-2026-72535

CVE.ORG link : CVE-2026-72535

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-72535", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72535", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T12:42:14.481361Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "Chaskiq", "product": "Chaskiq", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "46dfdd1"}]}]}], "published": "2026-08-11T12:17:38.733", "references": [{"url": "https://github.com/chaskiq/chaskiq", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account. An attacker can access and manage subscription data for any tenant without credentials."}, {"lang": "es", "value": "Una vulnerabilidad de autenticaci\u00f3n faltante en Chaskiq a trav\u00e9s del commit 46dfdd1 permite a atacantes remotos no autenticados generar sesiones del Portal de Facturaci\u00f3n de Stripe para cualquier inquilino a trav\u00e9s de la mutaci\u00f3n GraphQL stripeCustomerPortal. La mutaci\u00f3n no realiza comprobaciones de autenticaci\u00f3n ni de autorizaci\u00f3n antes de crear una sesi\u00f3n del portal del cliente vinculada a cualquier cuenta de Stripe de inquilino. Un atacante puede acceder y gestionar datos de suscripci\u00f3n para cualquier inquilino sin credenciales."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}