HIGH

CVE-2026-72536

2026-08-11 CVSS v3.1

CVSS

8.6

Description

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. An attacker can create payment intents and alter billing for any tenant without credentials.

Weakness (CWE)

CWE-306 Missing Authentication

EPSS Score

0.42%

Probability of exploitation in next 30 days

36.2th percentile

References

https://github.com/chaskiq/chaskiq

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE