CVE-2026-72535 Chaskiq Chaskiq - Missing Authentication
Unauthenticated attackers can mint Stripe Billing Portal sessions for any tenant, allowing unauthorized access and management of subscription data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72535?
CVE-2026-72535 is a high-severity missing authorization vulnerability in Chaskiq, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account. An attacker can access and manage subscription data for any tenant without credentials.
Weakness: CWE-306
Which versions are affected by CVE-2026-72535?
How do I fix CVE-2026-72535?
No fix has been published for CVE-2026-72535 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-72535 being exploited?
There is no known exploitation of CVE-2026-72535 in the wild and no public exploit code.
Sources
Also known as GHSA-hqqc-4mgp-grm6.