Executive brief
Ghostfolio, an open-source wealth management platform, contains a security flaw in how it handles shared portfolio links. An unauthorized person who obtains a private access ID can view a user's entire financial portfolio—including specific holdings, quantities, and purchase prices—without needing to log in. This could lead to the exposure of sensitive financial data for users who intended to share their information only with specific individuals.
Technical details
A missing authorization vulnerability (CWE-862) exists in the 'GET /api/v1/public/:accessId/portfolio' endpoint of Ghostfolio. The root cause is located in the public controller, which fails to validate the 'granteeUserId' field when retrieving access records via Prisma. While the application supports private sharing intended for specific authenticated users, the public endpoint accepts these private access IDs and returns full portfolio data—including holdings, buy prices, and performance metrics—without requiring authentication or an Impersonation-Id header. This bypasses the security logic implemented in the impersonation service. The vulnerability affects versions up to and including 3.6.0.
Affected products
- Ghostfolio Ghostfolio <= 3.6.0
Timeline
- 2026-06-01: disclosed: Reported via email to vendor
- 2026-07-07: advisory: CVE published to NVD