Search
Find a vulnerability
Search criteria
8 vulnerabilities by chaskiq
CVE-2026-72536 (GCVE-0-2026-72536)
Vulnerability from nvd – Published: 2026-08-11 11:07 – Updated: 2026-08-11 12:41
VLAI
EPSS
VEX
Title
Chaskiq Chaskiq - Missing Authentication
Summary
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. An attacker can create payment intents and alter billing for any tenant without credentials.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 12:41 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/chaskiq/chaskiq |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72536",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T12:41:25.782257Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T12:41:57.693Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chaskiq",
"vendor": "Chaskiq",
"versions": [
{
"lessThanOrEqual": "46dfdd1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bobur Abdugafforov (Mahadsec)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. An attacker can create payment intents and alter billing for any tenant without credentials."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:07:07.035Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Project Repository",
"url": "https://github.com/chaskiq/chaskiq"
}
],
"title": "Chaskiq Chaskiq - Missing Authentication"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72536",
"datePublished": "2026-08-11T11:07:07.035Z",
"dateReserved": "2026-08-10T10:32:49.080Z",
"dateUpdated": "2026-08-11T12:41:57.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72535 (GCVE-0-2026-72535)
Vulnerability from nvd – Published: 2026-08-11 11:06 – Updated: 2026-08-11 12:46
VLAI
EPSS
VEX
Title
Chaskiq Chaskiq - Missing Authentication
Summary
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account. An attacker can access and manage subscription data for any tenant without credentials.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 12:42 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/chaskiq/chaskiq |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72535",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T12:42:14.481361Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T12:46:08.211Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chaskiq",
"vendor": "Chaskiq",
"versions": [
{
"lessThanOrEqual": "46dfdd1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bobur Abdugafforov (Mahadsec)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account. An attacker can access and manage subscription data for any tenant without credentials."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:06:55.340Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Project Repository",
"url": "https://github.com/chaskiq/chaskiq"
}
],
"title": "Chaskiq Chaskiq - Missing Authentication"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72535",
"datePublished": "2026-08-11T11:06:55.340Z",
"dateReserved": "2026-08-10T10:32:49.080Z",
"dateUpdated": "2026-08-11T12:46:08.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-3857 (GCVE-0-2021-3857)
Vulnerability from nvd – Published: 2022-01-17 11:35 – Updated: 2024-08-03 17:09
VLAI
EPSS
VEX
Title
Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq
Summary
chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity
7.3 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://huntr.dev/bounties/18f7eaee-6309-40cb-aed… | x_refsource_CONFIRM |
| https://github.com/chaskiq/chaskiq/commit/bffa585… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| chaskiq | chaskiq/chaskiq |
Affected:
unspecified , ≤ 0.9.8
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:09:09.600Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/18f7eaee-6309-40cb-aed3-d5ac0af03cf3"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/chaskiq/chaskiq/commit/bffa585862b11cc05229ab3ed621d68f70ed33d0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "chaskiq/chaskiq",
"vendor": "chaskiq",
"versions": [
{
"lessThanOrEqual": "0.9.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-17T11:35:09.000Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/18f7eaee-6309-40cb-aed3-d5ac0af03cf3"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/chaskiq/chaskiq/commit/bffa585862b11cc05229ab3ed621d68f70ed33d0"
}
],
"source": {
"advisory": "18f7eaee-6309-40cb-aed3-d5ac0af03cf3",
"discovery": "EXTERNAL"
},
"title": "Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2021-3857",
"STATE": "PUBLIC",
"TITLE": "Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "chaskiq/chaskiq",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "0.9.8"
}
]
}
}
]
},
"vendor_name": "chaskiq"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/18f7eaee-6309-40cb-aed3-d5ac0af03cf3",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/18f7eaee-6309-40cb-aed3-d5ac0af03cf3"
},
{
"name": "https://github.com/chaskiq/chaskiq/commit/bffa585862b11cc05229ab3ed621d68f70ed33d0",
"refsource": "MISC",
"url": "https://github.com/chaskiq/chaskiq/commit/bffa585862b11cc05229ab3ed621d68f70ed33d0"
}
]
},
"source": {
"advisory": "18f7eaee-6309-40cb-aed3-d5ac0af03cf3",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2021-3857",
"datePublished": "2022-01-17T11:35:09.000Z",
"dateReserved": "2021-10-04T00:00:00.000Z",
"dateUpdated": "2024-08-03T17:09:09.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-3853 (GCVE-0-2021-3853)
Vulnerability from nvd – Published: 2022-01-17 11:25 – Updated: 2024-08-03 17:09
VLAI
EPSS
VEX
Title
Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq
Summary
chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity
6.5 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://huntr.dev/bounties/2b6a7647-8f2b-4510-b40… | x_refsource_CONFIRM |
| https://github.com/chaskiq/chaskiq/commit/51768b2… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| chaskiq | chaskiq/chaskiq |
Affected:
unspecified , < 0.9.8
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:09:09.541Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/2b6a7647-8f2b-4510-b40f-c52aedc2820d"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/chaskiq/chaskiq/commit/51768b21632dac89fd0dedb2b3b6d91bac732345"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "chaskiq/chaskiq",
"vendor": "chaskiq",
"versions": [
{
"lessThan": "0.9.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-17T11:25:09.000Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/2b6a7647-8f2b-4510-b40f-c52aedc2820d"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/chaskiq/chaskiq/commit/51768b21632dac89fd0dedb2b3b6d91bac732345"
}
],
"source": {
"advisory": "2b6a7647-8f2b-4510-b40f-c52aedc2820d",
"discovery": "EXTERNAL"
},
"title": "Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2021-3853",
"STATE": "PUBLIC",
"TITLE": "Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "chaskiq/chaskiq",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "0.9.8"
}
]
}
}
]
},
"vendor_name": "chaskiq"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/2b6a7647-8f2b-4510-b40f-c52aedc2820d",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/2b6a7647-8f2b-4510-b40f-c52aedc2820d"
},
{
"name": "https://github.com/chaskiq/chaskiq/commit/51768b21632dac89fd0dedb2b3b6d91bac732345",
"refsource": "MISC",
"url": "https://github.com/chaskiq/chaskiq/commit/51768b21632dac89fd0dedb2b3b6d91bac732345"
}
]
},
"source": {
"advisory": "2b6a7647-8f2b-4510-b40f-c52aedc2820d",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2021-3853",
"datePublished": "2022-01-17T11:25:09.000Z",
"dateReserved": "2021-10-03T00:00:00.000Z",
"dateUpdated": "2024-08-03T17:09:09.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-72536 (GCVE-0-2026-72536)
Vulnerability from cvelistv5 – Published: 2026-08-11 11:07 – Updated: 2026-08-11 12:41
VLAI
EPSS
VEX
Title
Chaskiq Chaskiq - Missing Authentication
Summary
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. An attacker can create payment intents and alter billing for any tenant without credentials.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 12:41 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/chaskiq/chaskiq |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72536",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T12:41:25.782257Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T12:41:57.693Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chaskiq",
"vendor": "Chaskiq",
"versions": [
{
"lessThanOrEqual": "46dfdd1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bobur Abdugafforov (Mahadsec)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. An attacker can create payment intents and alter billing for any tenant without credentials."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:07:07.035Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Project Repository",
"url": "https://github.com/chaskiq/chaskiq"
}
],
"title": "Chaskiq Chaskiq - Missing Authentication"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72536",
"datePublished": "2026-08-11T11:07:07.035Z",
"dateReserved": "2026-08-10T10:32:49.080Z",
"dateUpdated": "2026-08-11T12:41:57.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72535 (GCVE-0-2026-72535)
Vulnerability from cvelistv5 – Published: 2026-08-11 11:06 – Updated: 2026-08-11 12:46
VLAI
EPSS
VEX
Title
Chaskiq Chaskiq - Missing Authentication
Summary
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account. An attacker can access and manage subscription data for any tenant without credentials.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 12:42 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/chaskiq/chaskiq |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72535",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T12:42:14.481361Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T12:46:08.211Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chaskiq",
"vendor": "Chaskiq",
"versions": [
{
"lessThanOrEqual": "46dfdd1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bobur Abdugafforov (Mahadsec)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account. An attacker can access and manage subscription data for any tenant without credentials."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:06:55.340Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Project Repository",
"url": "https://github.com/chaskiq/chaskiq"
}
],
"title": "Chaskiq Chaskiq - Missing Authentication"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72535",
"datePublished": "2026-08-11T11:06:55.340Z",
"dateReserved": "2026-08-10T10:32:49.080Z",
"dateUpdated": "2026-08-11T12:46:08.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-3857 (GCVE-0-2021-3857)
Vulnerability from cvelistv5 – Published: 2022-01-17 11:35 – Updated: 2024-08-03 17:09
VLAI
EPSS
VEX
Title
Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq
Summary
chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity
7.3 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://huntr.dev/bounties/18f7eaee-6309-40cb-aed… | x_refsource_CONFIRM |
| https://github.com/chaskiq/chaskiq/commit/bffa585… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| chaskiq | chaskiq/chaskiq |
Affected:
unspecified , ≤ 0.9.8
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:09:09.600Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/18f7eaee-6309-40cb-aed3-d5ac0af03cf3"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/chaskiq/chaskiq/commit/bffa585862b11cc05229ab3ed621d68f70ed33d0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "chaskiq/chaskiq",
"vendor": "chaskiq",
"versions": [
{
"lessThanOrEqual": "0.9.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-17T11:35:09.000Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/18f7eaee-6309-40cb-aed3-d5ac0af03cf3"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/chaskiq/chaskiq/commit/bffa585862b11cc05229ab3ed621d68f70ed33d0"
}
],
"source": {
"advisory": "18f7eaee-6309-40cb-aed3-d5ac0af03cf3",
"discovery": "EXTERNAL"
},
"title": "Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2021-3857",
"STATE": "PUBLIC",
"TITLE": "Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "chaskiq/chaskiq",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "0.9.8"
}
]
}
}
]
},
"vendor_name": "chaskiq"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/18f7eaee-6309-40cb-aed3-d5ac0af03cf3",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/18f7eaee-6309-40cb-aed3-d5ac0af03cf3"
},
{
"name": "https://github.com/chaskiq/chaskiq/commit/bffa585862b11cc05229ab3ed621d68f70ed33d0",
"refsource": "MISC",
"url": "https://github.com/chaskiq/chaskiq/commit/bffa585862b11cc05229ab3ed621d68f70ed33d0"
}
]
},
"source": {
"advisory": "18f7eaee-6309-40cb-aed3-d5ac0af03cf3",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2021-3857",
"datePublished": "2022-01-17T11:35:09.000Z",
"dateReserved": "2021-10-04T00:00:00.000Z",
"dateUpdated": "2024-08-03T17:09:09.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-3853 (GCVE-0-2021-3853)
Vulnerability from cvelistv5 – Published: 2022-01-17 11:25 – Updated: 2024-08-03 17:09
VLAI
EPSS
VEX
Title
Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq
Summary
chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity
6.5 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://huntr.dev/bounties/2b6a7647-8f2b-4510-b40… | x_refsource_CONFIRM |
| https://github.com/chaskiq/chaskiq/commit/51768b2… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| chaskiq | chaskiq/chaskiq |
Affected:
unspecified , < 0.9.8
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:09:09.541Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/2b6a7647-8f2b-4510-b40f-c52aedc2820d"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/chaskiq/chaskiq/commit/51768b21632dac89fd0dedb2b3b6d91bac732345"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "chaskiq/chaskiq",
"vendor": "chaskiq",
"versions": [
{
"lessThan": "0.9.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-17T11:25:09.000Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/2b6a7647-8f2b-4510-b40f-c52aedc2820d"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/chaskiq/chaskiq/commit/51768b21632dac89fd0dedb2b3b6d91bac732345"
}
],
"source": {
"advisory": "2b6a7647-8f2b-4510-b40f-c52aedc2820d",
"discovery": "EXTERNAL"
},
"title": "Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2021-3853",
"STATE": "PUBLIC",
"TITLE": "Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "chaskiq/chaskiq",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "0.9.8"
}
]
}
}
]
},
"vendor_name": "chaskiq"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/2b6a7647-8f2b-4510-b40f-c52aedc2820d",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/2b6a7647-8f2b-4510-b40f-c52aedc2820d"
},
{
"name": "https://github.com/chaskiq/chaskiq/commit/51768b21632dac89fd0dedb2b3b6d91bac732345",
"refsource": "MISC",
"url": "https://github.com/chaskiq/chaskiq/commit/51768b21632dac89fd0dedb2b3b6d91bac732345"
}
]
},
"source": {
"advisory": "2b6a7647-8f2b-4510-b40f-c52aedc2820d",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2021-3853",
"datePublished": "2022-01-17T11:25:09.000Z",
"dateReserved": "2021-10-03T00:00:00.000Z",
"dateUpdated": "2024-08-03T17:09:09.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}