CVE-2026-72536: Chaskiq Auth Bypass Vulnerability

CVE-2026-72536 Overview

CVE-2026-72536 is a missing authentication vulnerability in Chaskiq, an open-source customer messaging platform. The flaw exists in the stripeCreateIntent GraphQL mutation through commit 46dfdd1. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated network callers. Attackers can create payment intents and manipulate billing for any tenant without valid credentials. The vulnerability is classified under [CWE-306] Missing Authentication for Critical Function.

Critical Impact
Unauthenticated remote attackers can manipulate any tenant's Stripe subscription and payment intents, resulting in financial fraud, billing tampering, and cross-tenant integrity loss.

Affected Products

Chaskiq customer messaging platform through commit 46dfdd1
Deployments exposing the GraphQL endpoint over the network
Multi-tenant installations integrated with Stripe billing

Discovery Timeline

2026-08-11 - CVE-2026-72536 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72536

Vulnerability Analysis

Chaskiq exposes a GraphQL API that includes payment-related mutations for Stripe integration. The stripeCreateIntent mutation triggers creation of a Stripe payment intent tied to a tenant's billing configuration. In vulnerable builds, the resolver omits both authentication and authorization checks. Any network client capable of reaching the GraphQL endpoint can invoke the mutation and specify tenant parameters.

Because the mutation directly interacts with the Stripe API using server-side credentials, an attacker leverages the application as a confused deputy. The result is unauthorized creation of payment intents and modification of subscription state across tenant boundaries. This breaks tenant isolation and enables billing manipulation without any prior compromise.

Root Cause

The root cause is a missing authentication guard on a security-critical GraphQL resolver. Chaskiq's resolver for stripeCreateIntent does not validate a session token, API key, or tenant ownership before executing the mutation. Authorization logic that should scope the operation to the authenticated user's tenant is absent. This is a classic [CWE-306] pattern where a privileged function is reachable by anonymous callers.

Attack Vector

The attack requires only network access to the Chaskiq GraphQL endpoint. An attacker sends a crafted GraphQL POST request invoking the stripeCreateIntent mutation with a target tenant identifier and desired payment parameters. No credentials, headers, or user interaction are needed. The server processes the mutation and issues the corresponding Stripe API call on behalf of the targeted tenant.

The vulnerability mechanism is documented in the Chaskiq GitHub repository. Technical details of the missing resolver guard are described in prose here rather than reproduced as exploit code, since no verified proof-of-concept has been published.

Detection Methods for CVE-2026-72536

Indicators of Compromise

Unauthenticated POST requests to /graphql containing the stripeCreateIntent mutation string
Stripe dashboard entries showing payment intents created outside normal user workflows
Cross-tenant subscription changes with no corresponding authenticated session in application logs
Requests to the GraphQL endpoint originating from unexpected source IPs without a preceding authentication call

Detection Strategies

Inspect web server and application logs for GraphQL requests referencing stripeCreateIntent and correlate against authenticated session records.
Enable GraphQL operation logging to capture the mutation name, variables, and requester identity for every call.
Reconcile Stripe payment intent creation events with authenticated tenant activity to surface orphaned or anomalous transactions.

Monitoring Recommendations

Alert on any GraphQL mutation invocation without an associated authenticated session token in the request context.
Monitor Stripe webhook events for payment_intent.created records that lack a matching internal user action.
Track baseline volume of billing-related mutations per tenant and flag statistical deviations for review.

How to Mitigate CVE-2026-72536

Immediate Actions Required

Restrict network access to the Chaskiq GraphQL endpoint using firewall rules or an authenticating reverse proxy until a fix is applied.
Rotate Stripe API keys if log review indicates any unauthorized stripeCreateIntent invocations.
Audit Stripe payment intents and subscription changes since deployment of the affected commit for signs of tampering.

Patch Information

No official vendor patch reference is available in the NVD entry at time of publication. Monitor the Chaskiq GitHub repository for commits that add authentication and tenant-scoped authorization to the stripeCreateIntent resolver. Apply the fix commit and rebuild the deployment as soon as it becomes available.

Workarounds

Add an authentication guard in the GraphQL resolver layer that rejects stripeCreateIntent calls lacking a valid session or API token.
Enforce tenant-scoped authorization so the resolver validates that the caller owns the target tenant identifier.
Place the GraphQL endpoint behind a reverse proxy that requires authenticated access before forwarding requests to Chaskiq.
Disable Stripe integration in Chaskiq configuration if billing features are not in use.

bash

# Configuration example: block unauthenticated access to the GraphQL endpoint at the reverse proxy
location /graphql {
    auth_request /_auth;
    proxy_pass http://chaskiq_backend;
}

location = /_auth {
    internal;
    proxy_pass http://auth_service/validate;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
}