CVE-2026-59708
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The GET /api/v1/public/:accessId/portfolio endpoint in Ghostfolio does not validate granteeUserId filtering, allowing unauthenticated attackers to retrieve full portfolio data using a private access ID.
Risk Assessment
The organization is at risk of leaking sensitive financial information such as holdings, quantities, buy prices, and performance metrics, potentially leading to financial loss and loss of customer trust.
Recommendation
Immediately update Ghostfolio to the latest version that implements proper granteeUserId validation and restrict access to the endpoint to authenticated users only.
Other vulnerabilities in Ghostfolio
See all- CVE-2026-47127Medium
Ghostfolio, an open source wealth management software, prior to version 3.4.0 has a vulnerability in the Stripe checkout success-URL handler that grants a Premium subscription without checking payment status. Any authenticated user can self-grant a 1-year Premium subscription without paying. Fixed in version 3.4.0.
- CVE-2026-59709Medium
The PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint in Ghostfolio fails to verify the Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting portfolio categorization and reports.
Original NVD description (English source)
The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings, quantities, buy prices, and performance metrics without authentication.