Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: ghostfolio Clear all filters
TI-2026-42581 CVE-2026-59708 · GHSA-fqj2-r74g-4gfp

Ghostfolio - Unauthorized Portfolio Data Exposure via Public Endpoint

Priority MEDIUM 44

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00593 Published 2026-07-07 No fix listed CWE-862
TI-2026-42582 CVE-2026-59709 · GHSA-w8j2-252j-wp53

Ghostfolio - Unauthorized Portfolio Holding Tag Modification via Missing Permission Check

Priority MEDIUM 57

Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio ho…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00336 Published 2026-07-07 No fix listed CWE-862