CVE-2026-72536: high vulnerability (CVSS 8.6)
CVE-2026-72536 in Chaskiq (commit 46dfdd1) allows unauthenticated attackers to exploit the stripeCreateIntent GraphQL mutation, manipulating Stripe subscriptions and creating payment intents for any tenant. This critical flaw stems from missing authentication and authorization checks.
Stripe-related vulnerabilities impact financial integrity. Immediate mitigation involves patching or disabling the vulnerable mutation. Monitor tenant billing for anomalies and consider isolating payment systems from GraphQL endpoints.
Chaskiq versions up to commit 46dfdd1 contain a critical flaw in the stripeCreateIntent GraphQL mutation. This mutation lacks proper authentication and authorization mechanisms, enabling unauthenticated attackers to manipulate Stripe payment intents for any tenant.
This vulnerability allows exploitation of financial systems, such as unauthorized creation of payment intents or alteration of subscription billing, posing severe risks to tenant data integrity and financial operations.
Administrators should immediately apply patches, disable the affected mutation if possible, and audit Stripe activity for suspicious transactions. Strengthening access controls around GraphQL endpoints is also recommended.