EUVD-2026-56006
GHSA-8wp4-ghqw-4g3h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Network-accessible unauthenticated GraphQL call with no prerequisites; High integrity reflects arbitrary cross-tenant billing manipulation; Low confidentiality and availability match incidental metadata exposure and partial disruption.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
5DescriptionCVE.org
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. An attacker can create payment intents and alter billing for any tenant without credentials.
AnalysisAI
Unauthenticated remote attackers can invoke the stripeCreateIntent GraphQL mutation in Chaskiq (through commit 46dfdd1) without any session or credential, enabling manipulation of Stripe payment intents for any tenant on the platform. The root cause is CWE-306 (Missing Authentication for Critical Function): the mutation bypasses all authentication and authorization checks, exposing a financial operation to the open internet. No public exploit or CISA KEV active exploitation has been identified at time of analysis, but the trivially low attack complexity (AV:N/AC:L/PR:N/UI:N) means any internet-reachable instance with Stripe configured is structurally exploitable.
Technical ContextAI
Chaskiq is an open-source, multi-tenant customer messaging and support platform (CPE: cpe:2.3:a:chaskiq:chaskiq:*:*:*:*:*:*:*:*) that exposes a GraphQL API for platform operations, including Stripe billing integration. The vulnerable mutation, stripeCreateIntent, is responsible for initiating Stripe PaymentIntent objects - a step in the Stripe payment lifecycle that creates a server-side payment record tied to a tenant's billing context. CWE-306 (Missing Authentication for Critical Function) identifies the root cause class: the mutation handler executes without verifying caller identity or tenant ownership, meaning any HTTP client that can reach the GraphQL endpoint can invoke it with arbitrary tenant parameters. In a multi-tenant SaaS architecture, this cross-tenant exposure compounds the risk, as a single unauthenticated request can target any tenant rather than only the attacker's own context.
RemediationAI
The primary fix is to add authentication and authorization enforcement to the stripeCreateIntent GraphQL mutation, requiring a valid authenticated session and verifying that the caller is authorized to act on the specified tenant's billing context. No specific patched release version has been confirmed in the available intelligence - only commit 46dfdd1 is cited as the upper boundary of affected code. Operators should review the Chaskiq GitHub repository (https://github.com/chaskiq/chaskiq) for commits beyond 46dfdd1 that address this mutation and deploy accordingly. As a compensating control pending a verified patch, operators can restrict network access to the GraphQL endpoint using a reverse proxy or WAF rule that blocks unauthenticated POST requests targeting the stripeCreateIntent mutation - noting that overly broad rules may disrupt legitimate authenticated traffic. Alternatively, disabling Stripe integration entirely eliminates the vulnerable code path at the cost of payment processing functionality. Placing the GraphQL API behind a VPN or internal network perimeter prevents external exploitation but does not address insider or compromised-account threat scenarios.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today