CVE-2026-47127
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Ghostfolio, an open source wealth management software, prior to version 3.4.0 has a vulnerability in the Stripe checkout success-URL handler that grants a Premium subscription without checking payment status. Any authenticated user can self-grant a 1-year Premium subscription without paying. Fixed in version 3.4.0.
Risk Assessment
An attacker could gain unauthorized access to Premium features, leading to financial losses and subscription integrity breaches.
Recommendation
Upgrade Ghostfolio to version 3.4.0, which includes the fix.
Other vulnerabilities in Ghostfolio
See all- CVE-2026-59708High
The GET /api/v1/public/:accessId/portfolio endpoint in Ghostfolio does not validate granteeUserId filtering, allowing unauthenticated attackers to retrieve full portfolio data using a private access ID.
- CVE-2026-59709Medium
The PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint in Ghostfolio fails to verify the Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting portfolio categorization and reports.
Original NVD description (English source)
Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at `GET /api/v1/subscription/stripe/callback?checkoutSessionId=<id>` retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the session's `client_reference_id` — without ever checking `session.payment_status` or `session.status`. There is no separate Stripe webhook endpoint with `stripe-signature` verification; this callback is the sole code path that creates Stripe-driven subscriptions. Any authenticated user can self-grant a 1-year Premium subscription without ever paying. Version 3.4.0 rejects sessions unless `session.payment_status === 'paid'` AND `session.status === 'complete'` (fails closed). Additionally, new unique `stripeCheckoutSessionId` column → a session can't be redeemed twice (race-safe via DB unique constraint).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS