CyberRota Analysis
AI-GeneratedA missing authentication vulnerability in Chaskiq allows unauthenticated remote attackers to manipulate any tenant's Stripe subscription through the stripeCreateIntent GraphQL mutation, which lacks necessary authentication and authorization checks. This flaw enables attackers to create and alter payment intents, potentially leading to unauthorized billing changes for any tenant. Organizations using Chaskiq, particularly those handling Stripe subscriptions, should prioritize patching this vulnerability to prevent exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. An attacker can create payment intents and alter billing for any tenant without credentials.