Read the docs

ghostfolio

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

ghostfolio records in CISA KEV

No ghostfolio vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-42582 CVE-2026-59709 · GHSA-w8j2-252j-wp53

Ghostfolio - Unauthorized Portfolio Holding Tag Modification via Missing Permission Check

Priority MEDIUM 57

Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio ho…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00336 Published 2026-07-07 No fix listed CWE-862
TI-2026-42581 CVE-2026-59708 · GHSA-fqj2-r74g-4gfp

Ghostfolio - Unauthorized Portfolio Data Exposure via Public Endpoint

Priority MEDIUM 44

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00593 Published 2026-07-07 No fix listed CWE-862
Open these records in search →