Unauthenticated GraphQL Mutation Exposes Stripe Payment Intent Creation

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. An attacker can create payment intents and alter billing for any tenant without credentials.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability represents a critical authentication bypass in Chaskiq's GraphQL API, where the stripeCreateIntent mutation lacks proper authentication and authorization controls. By exploiting CWE-306 (Missing Authentication for Critical Function), unauthenticated attackers can directly manipulate Stripe payment intents for any tenant, effectively gaining unauthorized access to billing systems and financial transactions. Organizations using Chaskiq for multi-tenant SaaS operations face immediate risk of subscription manipulation, fraudulent billing modifications, and potential financial loss across all customer accounts without any credentials required.

Casky's 283 matched skills leverage Claude AI's extended reasoning to detect the attack patterns associated with MITRE techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would observe findings highlighting: (1) unauthenticated GraphQL endpoint access patterns indicating missing authentication checks on sensitive mutations; (2) authorization bypass detection showing direct object references to payment intents without tenant isolation validation; (3) lateral movement indicators revealing how an attacker escalates from public API access to multi-tenant financial data manipulation. The platform's skill mapping would flag this as an API authentication gap, allowing security teams to identify similar patterns in their GraphQL implementations before exploitation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-72536.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-72536

Casky has 283 skills that investigate the attack patterns behind CVE-2026-72536. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn