CVE-2026-72535

The vulnerability in the stripeCustomerPortal mutation isn't just a broken authorization check — it's a signal about the entire GraphQL authorization model in Chaskiq. The mutation passes through without any authentication or tenant validation, allowing an attacker to mint Stripe Billing Portal sessions for any tenant on a shared instance. That's not a guessing game for tenant identifiers; it's open access to every tenant's billing context through a single API endpoint. The critical insight is what this bypass actually delivers: not just Chaskiq data, but a valid authenticated session to Stripe's own infrastructure. The Stripe Billing Portal exposes subscription status, payment methods, invoice history, and transaction records. By exploiting this mutation, an attacker gets all of that for any tenant — without touching Stripe's systems directly. This is an escalation from a local API bypass to authenticated access to a third-party financial system. Even more concerning is the lateral movement potential. Chaskiq deployments typically share a GraphQL endpoint, database, Redis instance, and Sidekiq workers across all tenants. Successfully invoking this mutation proves you can interact with Chaskiq's internal tenant resolution without credentials. From that foothold, explore what other tenant-context operations can be triggered through channels that bypass tenant isolation — particularly queued jobs that process across the shared worker infrastructure. The fix exists in commit 46dfdd1, meaning this was a code-level gap, not a configuration error. Either the developer implemented the mutation without following existing auth patterns, or those patterns themselves were incomplete. Either possibility means other mutations should be considered vulnerable until audited. Actionable steps: First, verify whether other mutations in the GraphQL layer lack authorization checks by reviewing mutations added since the last security review. Second, audit what tenant-context operations can be triggered through Sidekiq or Redis entry points — the mutation is the entry point, but the shared worker queue may be the real blast radius. Third, treat Stripe Billing Portal access as sensitive as the Chaskiq credentials themselves; the bypass effectively hands attackers Stripe sessions with full financial visibility. Fourth, implement schema-level or decorator-based auth enforcement for all GraphQL mutations going forward — the secure path must be the default path, not an opt-in.

Reviewed through automated stages and approved by a human before publication.