CVE-2026-72535 in Chaskiq
Summary
by MITRE • 08/11/2026
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account. An attacker can access and manage subscription data for any tenant without credentials.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical authentication bypass flaw in Chaskiq's GraphQL API implementation that directly violates fundamental security principles of access control and authorization. The issue stems from the stripeCustomerPortal mutation which was designed to facilitate customer portal sessions but lacks any form of authentication verification or tenant-specific authorization checks. This missing security layer creates an unprecedented attack surface where malicious actors can exploit the system without requiring valid credentials or permissions, effectively granting them administrative capabilities over any tenant's Stripe billing infrastructure.
The technical exploitation of this vulnerability occurs through a specific code commit that introduced the GraphQL mutation without proper access controls. When an attacker sends a request to the stripeCustomerPortal endpoint, the system processes the request without validating whether the requester has legitimate authorization to access or modify the target tenant's billing information. This flaw operates at the application layer and demonstrates a classic failure in implementing the principle of least privilege, where all authenticated users can potentially access any tenant's data through this unguarded mutation.
The operational impact of this vulnerability extends far beyond simple data exposure, as it provides attackers with complete control over subscription management for any tenant within the Chaskiq ecosystem. Attackers can access sensitive billing information, modify subscription details, cancel services, and potentially extract financial data from multiple tenants simultaneously. This represents a severe business continuity risk that could result in significant revenue loss, customer trust degradation, and regulatory compliance violations, particularly given the sensitive nature of payment processing and subscription management.
From a cybersecurity framework perspective, this vulnerability aligns with CWE-285 (Improper Authorization) and represents a direct violation of the ATT&CK technique T1078 (Valid Accounts) where attackers can leverage legitimate system functionality to gain unauthorized access. The lack of authentication checks constitutes a fundamental failure in the security architecture that violates industry best practices for API design and access control implementation. Organizations utilizing Chaskiq systems face substantial risk of financial fraud, data breaches, and service disruption if this vulnerability remains unaddressed.
The recommended mitigations involve implementing robust authentication mechanisms at the GraphQL endpoint level, requiring proper tenant identification and authorization validation before executing any billing operations. Security teams should enforce role-based access controls that ensure only authorized administrators can create customer portal sessions for specific tenants, while also implementing comprehensive logging and monitoring to detect unauthorized access attempts. Additionally, organizations must conduct thorough security reviews of all GraphQL mutations to identify similar vulnerabilities and establish automated testing procedures to prevent such issues in future development cycles.