Skip to content
OpenAdvisories

Vendor

ghostfolio

5 known vulnerabilities.

Products

ghostfolio 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-47127

    Ghostfolio has a Stripe subscription bypass

    Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at `GET /api/v1/subscription/stripe/callback?checkoutSessionId=<id>` retrieves the Stripe Checkout Session by ID and unconditiona…

    ghostfolio ghostfolio
  • Medium 4.3
    CVE-2026-59709

    Ghostfolio - Unauthorized Portfolio Holding Tag Modification via Missing Permission Check

    Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-o…

    ghostfolio ghostfolio