Executive brief
Chaskiq is a customer communication and support platform with built-in live chat and marketing capabilities. An unauthenticated attacker can bypass security controls to create Stripe Billing Portal sessions for any tenant organization, potentially allowing unauthorized access to subscription management, billing data, and payment information across all customers using the platform.
Technical details
The vulnerability is an authentication bypass in the stripeCustomerPortal GraphQL mutation that fails to validate user credentials or authorization before processing requests. The mutation creates a customer portal session linked to any tenant's Stripe account without checking if the requester is authenticated or has permission to access that tenant's data. An attacker with network access to the GraphQL endpoint can exploit this remotely by calling the mutation with an arbitrary tenant identifier. This allows unauthorized access to billing and subscription data for all affected organizations, affecting confidentiality and potentially integrity of financial records.
Affected products
- Chaskiq Chaskiq through commit 46dfdd1
Timeline
- 2026-08-11: published