A missing authentication flaw in Chaskiq allows remote attackers to invoke the stripeCustomerPortal GraphQL mutation without providing any credentials. The mutation creates a Stripe Billing Portal session linked to any tenant’s Stripe account, giving the attacker full visibility and control over subscription data for that tenant. The issue is a pure authentication bypass (CWE‑306) that allows unauthorized changes to billing configurations.

All Chaskiq deployments that include the code up to and including commit 46dfdd1 are vulnerable, as the mutation performs no authentication or authorization checks. Tenants running any unpatched version of the platform can be affected, regardless of the number of users or the size of the customer base.

The CVSS score of 8.2 indicates a high severity, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that attackers can exploit the weakness remotely by sending a GraphQL request to the public endpoint, requiring no prior authentication. Successful exploitation permits the attacker to view and manipulate subscription information for any tenant.