CVE-2026-72536

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. An attacker can create payment intents and alter billing for any tenant without credentials.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/chaskiq/chaskiq

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de autenticación faltante en Chaskiq a través del commit 46dfdd1 permite a atacantes remotos no autenticados manipular cualquier suscripción de Stripe de cualquier inquilino a través de la mutación GraphQL stripeCreateIntent. La mutación carece de comprobaciones de autenticación y autorización, exponiendo la creación de intenciones de pago de Stripe a llamadores no autenticados. Un atacante puede crear intenciones de pago y alterar la facturación para cualquier inquilino sin credenciales.

Information

Published : 2026-08-11 12:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-72536

Mitre link : CVE-2026-72536

CVE.ORG link : CVE-2026-72536

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-72536", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72536", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T12:41:25.782257Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "Chaskiq", "product": "Chaskiq", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "46dfdd1"}]}]}], "published": "2026-08-11T12:17:38.857", "references": [{"url": "https://github.com/chaskiq/chaskiq", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. An attacker can create payment intents and alter billing for any tenant without credentials."}, {"lang": "es", "value": "Una vulnerabilidad de autenticaci\u00f3n faltante en Chaskiq a trav\u00e9s del commit 46dfdd1 permite a atacantes remotos no autenticados manipular cualquier suscripci\u00f3n de Stripe de cualquier inquilino a trav\u00e9s de la mutaci\u00f3n GraphQL stripeCreateIntent. La mutaci\u00f3n carece de comprobaciones de autenticaci\u00f3n y autorizaci\u00f3n, exponiendo la creaci\u00f3n de intenciones de pago de Stripe a llamadores no autenticados. Un atacante puede crear intenciones de pago y alterar la facturaci\u00f3n para cualquier inquilino sin credenciales."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}