CVE-2026-47127
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Ghostfolio, an open source wealth management software, prior to version 3.4.0 has a vulnerability in the Stripe checkout success-URL handler that grants a Premium subscription without checking payment status. Any authenticated user can self-grant a 1-year Premium subscription without paying. Fixed in version 3.4.0.
Risk Assessment
An attacker could gain unauthorized access to Premium features, leading to financial losses and subscription integrity breaches.
Recommendation
Upgrade Ghostfolio to version 3.4.0, which includes the fix.
Original NVD description (English source)
Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at `GET /api/v1/subscription/stripe/callback?checkoutSessionId=<id>` retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the session's `client_reference_id` — without ever checking `session.payment_status` or `session.status`. There is no separate Stripe webhook endpoint with `stripe-signature` verification; this callback is the sole code path that creates Stripe-driven subscriptions. Any authenticated user can self-grant a 1-year Premium subscription without ever paying. Version 3.4.0 rejects sessions unless `session.payment_status === 'paid'` AND `session.status === 'complete'` (fails closed). Additionally, new unique `stripeCheckoutSessionId` column → a session can't be redeemed twice (race-safe via DB unique constraint).