CVE-2026-72535

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-72535

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72535.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-72535

Published

2026-08-11T11:06:55Z

Modified

2026-10-21T02:59:11Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L CVSS Calculator

Summary

Chaskiq Chaskiq - Missing Authentication

Details

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account. An attacker can access and manage subscription data for any tenant without credentials.

Database specific

{
    "cna_assigner":  "TuranSec",
    "cwe_ids":  [
        "CWE-306"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72535.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "last_affected":  "46dfdd1"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/chaskiq/chaskiq

Affected ranges

Type

GIT

Repo

https://github.com/chaskiq/chaskiq

Events

Introduced

Last Affected

46dfdd1

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "46dfdd1"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72535.json"