CVE-2026-72536
Chaskiq Chaskiq - Missing Authentication
- State
- Published
- Severity
- 8.2 High
- Published
- Aug 11, 2026
- Updated
- Aug 11, 2026
- Reserved
- Aug 10, 2026
Description
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. An attacker can create payment intents and alter billing for any tenant without credentials.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.2 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L | TuranSec |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
ChaskiqChaskiq |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.