CVE-2026-72536 Chaskiq CVE debrief

Who should care

Organizations using Chaskiq, administrators of Chaskiq installations, security teams responsible for monitoring and securing Stripe subscriptions, and operators managing affected systems should be aware of this vulnerability. They should verify their installations, ensure proper security measures are in place, and monitor for suspicious activity related to Stripe subscription manipulation to prevent potential financial loss or data exposure.

Technical summary

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. This could lead to unauthorized creation of payment intents and alteration of billing for any tenant without credentials.

Defensive priority

Organizations using Chaskiq should verify their installations and ensure that Stripe subscriptions are properly secured.

Recommended defensive actions

• Verify Chaskiq installations to ensure proper security measures are in place.
• Restrict access to Stripe subscription management to authenticated and authorized users.
• Monitor for suspicious activity related to Stripe subscription manipulation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE description indicates a missing authentication vulnerability in Chaskiq through commit 46dfdd1, allowing unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. To verify, defenders should review Chaskiq installations, check for proper security measures, and monitor for suspicious activity related to Stripe subscription manipulation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.