CVE-2026-72536: Chaskiq Chaskiq - Missing Authentication
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. An attacker can create payment intents and alter billing for any tenant without credentials.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72536?
The severity of CVE-2026-72536 is high with a score of 8.2.
How do I fix CVE-2026-72536?
To fix CVE-2026-72536, implement proper authentication and authorization checks for the stripeCreateIntent GraphQL mutation.
What consequences can arise from CVE-2026-72536?
CVE-2026-72536 allows unauthenticated attackers to manipulate tenant Stripe subscriptions, potentially leading to unauthorized charges.
Which software is affected by CVE-2026-72536?
The vulnerability affects the Chaskiq software.
When was CVE-2026-72536 published?
CVE-2026-72536 was published on August 11, 2026.