CVE-2026-72536 exposes a GraphQL mutation in Chaskiq that creates Stripe payment intents without any authentication check. The blast radius is severe: any tenant can create payment intents against any Stripe subscription connected to the platform. This isn't just a data exposure — it's a financial instrument creation vulnerability that propagates into Stripe's transaction network, creating exposure to chargebacks, fraud, and downstream merchant disruption.
The root cause follows a well-documented pattern. Developers consistently assume that a server-side Stripe API key provides implicit authentication, forgetting that the GraphQL mutation itself is exposed to unauthenticated callers. Stripe has warned about this misconception since 2015, yet it recurs across implementations. The vulnerability typically calcifies early in a project's lifecycle during the "rush to ship billing" phase — payment code gets written quickly, works silently, and generates no alerts that would prompt security review. Once shipped, it sediments into production without being touched for years.
Audit your GraphQL API for mutations that touch third-party services — payment providers, email services, webhook handlers. These integrations often shipped under the same assumption that the external service "handles auth," creating identical gaps. Implement explicit auth declarations as a required pattern for any mutation that makes external API calls, and consider adding linter rules that flag mutations touching external services without documented authentication. The absence of automated enforcement means missing auth manifests as silence rather than a review failure, which is why these vulnerabilities persist undetected.