CVE-2026-72535 Chaskiq CVE debrief

Who should care

Organizations using Chaskiq, especially those with Stripe Billing Portal integrations, should be aware of this vulnerability and take immediate action to protect their tenants' subscription data. This includes verifying the presence of commit 46dfdd1 or a later version, restricting access to the GraphQL mutation, and implementing additional monitoring to detect potential exploitation attempts. Security teams and vulnerability management teams should prioritize defensive actions due to the high CVSS score of 8.6 and the potential for unauthenticated remote attacks.

Technical summary

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account. This vulnerability enables attackers to access and manage subscription data for any tenant without credentials, posing a significant risk to tenant data security.

Defensive priority

High-priority defensive actions are required due to the high CVSS score of 8.6 and the potential for unauthenticated remote attackers to access and manage subscription data for any tenant.

Recommended defensive actions

• Verify Chaskiq installation for the presence of commit 46dfdd1 or a later version that addresses the vulnerability.
• Restrict access to the GraphQL mutation stripeCustomerPortal to authenticated and authorized users.
• Implement additional monitoring to detect potential exploitation attempts.
• Review and update Stripe Billing Portal configurations to minimize potential impact.
• Consider applying compensating controls, such as IP restrictions or rate limiting, to mitigate the risk.

Evidence notes

Evidence is based on the official CVE Program record and NIST NVD vulnerability detail. The CVE description indicates a missing authentication vulnerability in Chaskiq, allowing unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant. The vulnerability is associated with commit 46dfdd1 and affects Chaskiq installations prior to this commit. Defenders should verify the presence of this commit or a later version in their Chaskiq installations and review Stripe Billing Portal configurations to minimize potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.