CVE-2026-72535

Name of the Vulnerable Software and Affected Versions Chaskiq versions prior to commit 46dfdd1

Description A missing authentication issue allows unauthenticated remote attackers to create Stripe Billing Portal sessions for any tenant. This occurs via the stripeCustomerPortal GraphQL mutation, which fails to perform authentication or authorization checks before linking a session to a tenant Stripe account. Consequently, an attacker can access and manage subscription data for any tenant without providing credentials.

Recommendations Update Chaskiq to a version including commit 46dfdd1 or later. As a temporary mitigation, restrict access to the stripeCustomerPortal GraphQL mutation.