CVE-2026-59708: Ghostfolio Private Portfolio Authorization Bypass—Financial Data Exposure

Technical summary

CVE-2026-59708 is an authorization flaw in Ghostfolio's public portfolio API endpoint. The vulnerable endpoint (/api/v1/public/:accessId/portfolio) accepts private access IDs but fails to properly enforce granteeUserId filtering, resulting in improper access control (CWE-862). The API returns full portfolio data—holdings, quantities, cost basis, and performance metrics—without validating that the requester has legitimate access rights. The vulnerability is unauthenticated, network-accessible, and requires only knowledge of a valid private access ID. CVSS 3.1 score of 7.5 (HIGH) reflects the high confidentiality impact from unauthorized disclosure of financial data, with no integrity or availability compromise.

Business impact

This vulnerability exposes users' investment strategies and financial positions to unauthorized disclosure. Portfolio owners who share private access IDs with trusted parties risk exposure if those IDs are compromised, leaked, or guessed. For wealth management firms, investment advisors, or financial platforms using Ghostfolio, the breach could violate client confidentiality, trigger regulatory reporting obligations (SOX, HIPAA, GDPR, or similar), and erode client trust. The reputational damage from unauthorized financial data exposure can be substantial, particularly if high-net-worth portfolios are affected. Affected organizations may face legal liability, incident response costs, and notification obligations depending on jurisdiction and data sensitivity.

Affected systems

Ghostfolio instances are affected by this vulnerability. The specific affected versions are not detailed in the provided advisory; organizations running Ghostfolio should check the vendor's official security advisory or release notes to determine which versions are vulnerable and which patches resolve the issue. This vulnerability affects deployments where the public portfolio sharing feature is enabled and private access IDs are in circulation.

Exploitability

Exploitation is straightforward and requires minimal effort. An attacker needs only a valid private access ID and the ability to send an HTTP GET request to the vulnerable endpoint. No authentication, special privileges, or user interaction is needed. Access IDs may be obtained through social engineering, accidental disclosure (e.g., shared in chat or email), URL enumeration, or data breaches. The attack surface is broad because anyone on the internet with network access to the Ghostfolio instance can attempt exploitation. The lack of rate limiting or additional validation mechanisms makes large-scale reconnaissance feasible.

Remediation

The vendor should implement proper authorization validation that ensures the granteeUserId in the access control list matches the requesting user before returning portfolio data. Immediate mitigations include: verifying that the endpoint properly enforces access restrictions, reviewing access logs for unauthorized API calls, rotating or revoking private access IDs if compromise is suspected, and restricting portfolio sharing to trusted recipients only. Apply the vendor's security patch as soon as it is available and tested. Organizations should also audit who has received private access IDs and consider implementing additional controls such as IP whitelisting or time-limited access tokens.

Patch guidance

Consult the Ghostfolio vendor advisory for specific patched versions and deployment instructions. After patching, verify that the authorization checks are functioning correctly by testing access to a private portfolio with an unauthorized access ID—the system should deny the request. Update all instances of Ghostfolio, including development, staging, and production environments. Test the patch in a non-production environment first to ensure compatibility with your deployment. If running Ghostfolio as a service (e.g., in Docker or Kubernetes), ensure container images and orchestration configs are updated to pull the patched version.

Detection guidance

Monitor API access logs for GET requests to /api/v1/public/:accessId/portfolio endpoints with unusual access patterns: requests from unexpected IP addresses, high request volumes to the same endpoint, sequential accessId enumeration attempts, or requests outside normal business hours. Set up alerting for unauthorized access attempts or 200-status responses to portfolio endpoints. Review recent access logs to identify if the vulnerability was exploited before patching. Implement Web Application Firewall (WAF) rules to rate-limit or block repeated requests to the endpoint if they appear suspicious. Consider enabling API gateway logging and correlation with user activity to detect compromised access IDs.

Why prioritize this

This vulnerability warrants high-priority patching because it enables direct, unauthenticated access to sensitive financial data with minimal attacker effort. The high CVSS score (7.5) reflects the confidentiality impact of portfolio disclosure. Financial data is a target for competitive intelligence gathering, blackmail, and market manipulation. The ease of exploitation and broad attack surface mean that active exploitation is likely if the vulnerability becomes public. Organizations managing investment portfolios or providing portfolio analytics should treat this as a critical security issue.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is calculated from: Attack Vector: Network (AV:N)—the vulnerability is exploitable over the network without physical access; Attack Complexity: Low (AC:L)—no special conditions are required; Privileges Required: None (PR:N)—unauthenticated attackers can exploit it; User Interaction: None (UI:N)—no user action is needed; Scope: Unchanged (S:U)—the vulnerability does not affect resources outside the affected portfolio; Confidentiality Impact: High (C:H)—sensitive financial data is disclosed; Integrity Impact: None (I:N)—no data modification occurs; Availability Impact: None (A:N)—no service disruption results. The high confidentiality impact combined with low barriers to exploitation drives the HIGH severity rating.

Frequently asked questions