CVE-2026-72535: Chaskiq Chaskiq - Missing Authentication

Q: What is the severity of CVE-2026-72535?

The severity of CVE-2026-72535 is high with a score of 8.2.

Q: How do I fix CVE-2026-72535?

To fix CVE-2026-72535, ensure that proper authentication and authorization checks are implemented for the stripeCustomerPortal GraphQL mutation.

Q: What software is affected by CVE-2026-72535?

CVE-2026-72535 affects the Chaskiq software.

Q: What is the impact of CVE-2026-72535?

CVE-2026-72535 allows unauthenticated remote attackers to create Stripe Billing Portal sessions for any tenant.

Q: When was CVE-2026-72535 published?

CVE-2026-72535 was published on August 11, 2026.

Published Aug 11, 2026

Updated

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account. An attacker can access and manage subscription data for any tenant without credentials.

Affected Software

1 affected component

Chaskiq<46dfdd1

Event History

Aug 11, 2026

CVE Published

via MITRE·11:06 AM

Data Sourced

via MITRE·11:06 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-72535?

The severity of CVE-2026-72535 is high with a score of 8.2.

How do I fix CVE-2026-72535?

To fix CVE-2026-72535, ensure that proper authentication and authorization checks are implemented for the stripeCustomerPortal GraphQL mutation.

What software is affected by CVE-2026-72535?