CVE-2026-72536

Name of the Vulnerable Software and Affected Versions Chaskiq versions prior to commit 46dfdd1

Description A missing authentication issue allows unauthenticated remote attackers to manipulate Stripe subscriptions for any tenant. This occurs because the stripeCreateIntent GraphQL mutation lacks necessary authentication and authorization checks, enabling unauthorized users to create payment intents and alter billing details without credentials.

Recommendations Update Chaskiq to a version that includes commit 46dfdd1 or later. As a temporary mitigation, restrict access to the stripeCreateIntent GraphQL mutation.