Skip to content
Threat Feed
Subscribe

Product

Ghostfolio <= 3.6.0

1 brief RSS
high advisory

CVE-2026-59708: Ghostfolio Unauthenticated Portfolio Data Exposure

An authorization bypass vulnerability (CVE-2026-59708) in Ghostfolio's GET /api/v1/public/:accessId/portfolio endpoint allows unauthenticated attackers with a private access ID to retrieve sensitive financial portfolio data, including holdings and performance metrics, due to missing `granteeUserId` filtering validation.

ghostfolio <= 3.6.0 vulnerability api authorization-bypass data-exposure webserver
3t 1c