Ghostfolio vulnerabilities
3 known CVE vulnerabilities in Ghostfolio, translated and rated.
- CVE-2026-47127Medium
Ghostfolio, an open source wealth management software, prior to version 3.4.0 has a vulnerability in the Stripe checkout success-URL handler that grants a Premium subscription without checking payment status. Any authenticated user can self-grant a 1-year Premium subscription without paying. Fixed in version 3.4.0.
- CVE-2026-59708High
The GET /api/v1/public/:accessId/portfolio endpoint in Ghostfolio does not validate granteeUserId filtering, allowing unauthenticated attackers to retrieve full portfolio data using a private access ID.
- CVE-2026-59709Medium
The PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint in Ghostfolio fails to verify the Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting portfolio categorization and reports.