CVE-2026-59708: Ghostfolio

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings, quantities, buy prices, and performance metrics without authentication.

Affected products

• Ghostfolio Ghostfolio: up to and including 3.6.0

Published 2026-07-07. Last modified 2026-09-17.