A missing authentication and authorization check in the stripeCreateIntent GraphQL mutation allows remote attackers to create payment intents and change billing for any tenant without credentials. The vulnerability can be exploited through unauthenticated calls, leading to unauthorized charges, financial loss, and potential fraud against site users. The weakness is a classic case of CWE-306, where lack of proper authentication opens the door for attackers to perform privileged operations.

The vulnerability affects the Chaskiq platform, specifically any installation using the stripeCreateIntent mutation. No specific version numbers are listed in the CNA data; the issue originates from commit 46dfdd1 and therefore all current and past releases built from that code are potentially impacted. Administrators should review their Chaskiq deployments for this mutation and any unprotected GraphQL endpoints.

The CVSS score of 8.2 classifies this flaw as high severity, and although there is no EPSS value available, the lack of authentication means an attacker could easily trigger the vulnerability remotely. The issue is not yet listed in CISA's KEV catalog. Exploitation requires only the ability to send GraphQL queries to the server; no prior credentials or foothold are necessary. Consequently, the risk remains high and the likelihood of exploitation is significant if the application continues to expose the vulnerable mutation.