What is the CVSS score of EUVD-2026-56005?

EUVD-2026-56005 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.4%.

Which versions of Chaskiq are affected by EUVD-2026-56005?

Chaskiq instances with Stripe Billing enabled are vulnerable to unauthenticated cross-tenant subscription manipulation, allowing attackers to modify or cancel subscriptions for arbitrary customers…

How to fix or mitigate EUVD-2026-56005?

Within 24 hours: disable or isolate the Stripe Billing Portal integration in Chaskiq, or restrict network access to the GraphQL endpoint to known trusted IP ranges only; begin forensic review of stripeCustomerPortal mutation logs for the past 30 days to detect unauthorized activity. Within 7 days: implement application-level access controls via API gateway or WAF to block unauthenticated stripeCustomerPortal GraphQL mutations; deploy continuous alerting on all Stripe API calls to detect anomalous subscription changes. Within 30 days: upgrade Chaskiq to a patched version after commit 46dfdd1 that includes authentication checks on the stripeCustomerPortal mutation; coordinate with Chaskiq vendor to confirm remediation release; conduct a complete subscription audit to identify and reverse any unauthorized modifications made during the vulnerability window.

Chaskiq EUVD-2026-56005

| CVE-2026-72535 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-11 TuranSec

GHSA-hqqc-4mgp-grm6

Authentication Bypass Chaskiq

8.6

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

vuln.today AI

8.6 HIGH

Network-accessible unauthenticated GraphQL endpoint requires no privileges or interaction; I:H reflects subscription cancellation/modification capability; C:L scoped to Stripe billing portal data only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Updated

Aug 11, 2026 - 12:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 11, 2026 - 12:22 vuln.today

cvss_changed

CVSS changed

Aug 11, 2026 - 12:22 NVD

8.2 (HIGH) 8.6 (HIGH)

Analysis Generated

Aug 11, 2026 - 12:03 vuln.today

CVE Published

Aug 11, 2026 - 11:06 cve.org

HIGH 8.2

DescriptionCVE.org

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account. An attacker can access and manage subscription data for any tenant without credentials.

AnalysisAI

Unauthenticated remote access to Stripe Billing Portal sessions in Chaskiq through commit 46dfdd1 allows any attacker to mint valid customer portal sessions for arbitrary tenants by invoking the stripeCustomerPortal GraphQL mutation without credentials. The mutation performs zero authentication or tenant-ownership checks before calling the Stripe API, enabling cross-tenant subscription manipulation - including plan changes and cancellations - against any Chaskiq-hosted tenant with Stripe Billing configured. No public exploit code has been identified at time of analysis, though the attack surface requires only network access and knowledge of a target tenant identifier.

Technical ContextAI

Chaskiq is an open-source, multi-tenant customer messaging and live chat platform built on Ruby on Rails exposing a GraphQL API. The vulnerable surface is the stripeCustomerPortal GraphQL mutation, which interfaces with Stripe's Billing Portal API to generate time-limited session URLs granting customers access to subscription management. The root cause is CWE-306 (Missing Authentication for Critical Function): the mutation's resolver executes the Stripe API call without validating any session token, bearer credential, or tenant-scoped identity, bypassing both authentication (who are you?) and authorization (are you allowed to act on this tenant?). In a multi-tenant architecture, this means any caller can supply an arbitrary tenant identifier and receive a valid Stripe portal session scoped to that tenant's Stripe account. The affected CPE is cpe:2.3:a:chaskiq:chaskiq:*:*:*:*:*:*:*:*, covering all versions through commit 46dfdd1 per EUVD-2026-56005.

RemediationAI

No vendor-released patch with a confirmed version tag has been identified at time of analysis - operators should monitor the upstream repository at https://github.com/chaskiq/chaskiq for commits beyond 46dfdd1 that address authentication on the stripeCustomerPortal mutation. As an immediate compensating control, restrict unauthenticated access to the GraphQL endpoint at the reverse proxy or WAF layer by blocking or requiring authentication on POST requests to /graphql that include the stripeCustomerPortal operation name; this will prevent unauthenticated exploitation but requires careful validation to avoid breaking legitimate authenticated flows. Operators should also review Stripe account access logs for anomalous Billing Portal session creation events across tenants, and consider temporarily disabling the Stripe Billing Portal feature in Stripe's dashboard if the integration is not actively needed, which removes the impact surface entirely at the cost of disabling self-serve subscription management for all tenants.