Security Advisory
CVE-2026-59708
7.5
HIGH
Vulnerability Description
The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings, quantities, buy prices, and performance metrics without authentication.
Published Date
July 7, 2026
Official Source
NIST NVD Advisory