CVE-2026-47127 Details
Description
Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at `GET /api/v1/subscription/stripe/callback?checkoutSessionId=<id>` retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the session's `client_reference_id` — without ever checking `session.payment_status` or `session.status`. There is no separate Stripe webhook endpoint with `stripe-signature` verification; this callback is the sole code path that creates Stripe-driven subscriptions. Any authenticated user can self-grant a 1-year Premium subscription without ever paying. Version 3.4.0 rejects sessions unless `session.payment_status === 'paid'` AND `session.status === 'complete'` (fails closed). Additionally, new unique `stripeCheckoutSessionId` column → a session can't be redeemed twice (race-safe via DB unique constraint).
A vulnerability in Ghostfolio's Stripe checkout success URL handler prior to version 3.4.0 allows any authenticated user to self-grant a one-year Premium subscription without payment. The callback handler retrieves the Stripe Checkout Session by ID and automatically grants a subscription based on the session's client reference ID, without verifying the payment status or session status. This callback is the only method for creating Stripe-driven subscriptions, as there is no separate webhook endpoint with signature verification. The vulnerability is present in Ghostfolio deployments with the subscription feature enabled.
Users can update to Ghostfolio version 3.4.0 or later, where this vulnerability is fixed. Instructions for updating can be found in the Ghostfolio repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ghostfolio/ghostfolio/security/advisories/GHSA-j465-x2w3-wjj8 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ghostfolio/ghostfolio/pull/6872 | [email protected] | Issue TrackingVendor |
| https://github.com/ghostfolio/ghostfolio/security/advisories/GHSA-j465-x2w3-wjj8 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ghostfolio | < 3.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 13, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |