What is CVE-2026-72535?

CVE-2026-72535 is a high-severity vulnerability in Chaskiq, classified under Missing Authentication for Critical Function. CVSS score: 8.6/10. Published 2026-08-11.

How severe is CVE-2026-72535?

High severity. CVSS v3 base score is 8.6 out of 10.

Auth bypass in Chaskiq

CVE-2026-72535

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no…

Vulnerability class: Broken Authentication

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L.

Affected products

Chaskiq — versions 0

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Frequently asked questions

What is CVE-2026-72535?: CVE-2026-72535 is a high-severity vulnerability in Chaskiq, classified under Missing Authentication for Critical Function. CVSS score: 8.6/10. Published 2026-08-11.
How severe is CVE-2026-72535?: High severity. CVSS v3 base score is 8.6 out of 10.