Chaskiq
Monthly
Unauthenticated remote attackers can invoke the stripeCreateIntent GraphQL mutation in Chaskiq (through commit 46dfdd1) without any session or credential, enabling manipulation of Stripe payment intents for any tenant on the platform. The root cause is CWE-306 (Missing Authentication for Critical Function): the mutation bypasses all authentication and authorization checks, exposing a financial operation to the open internet. No public exploit or CISA KEV active exploitation has been identified at time of analysis, but the trivially low attack complexity (AV:N/AC:L/PR:N/UI:N) means any internet-reachable instance with Stripe configured is structurally exploitable.
Unauthenticated remote access to Stripe Billing Portal sessions in Chaskiq through commit 46dfdd1 allows any attacker to mint valid customer portal sessions for arbitrary tenants by invoking the `stripeCustomerPortal` GraphQL mutation without credentials. The mutation performs zero authentication or tenant-ownership checks before calling the Stripe API, enabling cross-tenant subscription manipulation - including plan changes and cancellations - against any Chaskiq-hosted tenant with Stripe Billing configured. No public exploit code has been identified at time of analysis, though the attack surface requires only network access and knowledge of a target tenant identifier.
Unauthenticated remote attackers can invoke the stripeCreateIntent GraphQL mutation in Chaskiq (through commit 46dfdd1) without any session or credential, enabling manipulation of Stripe payment intents for any tenant on the platform. The root cause is CWE-306 (Missing Authentication for Critical Function): the mutation bypasses all authentication and authorization checks, exposing a financial operation to the open internet. No public exploit or CISA KEV active exploitation has been identified at time of analysis, but the trivially low attack complexity (AV:N/AC:L/PR:N/UI:N) means any internet-reachable instance with Stripe configured is structurally exploitable.
Unauthenticated remote access to Stripe Billing Portal sessions in Chaskiq through commit 46dfdd1 allows any attacker to mint valid customer portal sessions for arbitrary tenants by invoking the `stripeCustomerPortal` GraphQL mutation without credentials. The mutation performs zero authentication or tenant-ownership checks before calling the Stripe API, enabling cross-tenant subscription manipulation - including plan changes and cancellations - against any Chaskiq-hosted tenant with Stripe Billing configured. No public exploit code has been identified at time of analysis, though the attack surface requires only network access and knowledge of a target tenant identifier.