CVE-2026-47127

Received Received - Intake

Premium Subscription Bypass in Ghostfolio

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at `GET /api/v1/subscription/stripe/callback?checkoutSessionId=<id>` retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the session's `client_reference_id` — without ever checking `session.payment_status` or `session.status`. There is no separate Stripe webhook endpoint with `stripe-signature` verification; this callback is the sole code path that creates Stripe-driven subscriptions. Any authenticated user can self-grant a 1-year Premium subscription without ever paying. Version 3.4.0 rejects sessions unless `session.payment_status === 'paid'` AND `session.status === 'complete'` (fails closed). Additionally, new unique `stripeCheckoutSessionId` column → a session can't be redeemed twice (race-safe via DB unique constraint).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-47127

Affected Vendors & Products

Vendor	Product	Version / Range
ghostfolio	ghostfolio	to 3.4.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Ghostfolio is a wealth management software. A flaw in versions before 3.4.0 allows unauthenticated users to grant themselves a Premium subscription without payment. The system retrieves Stripe Checkout Session details but fails to verify payment status or session completion before granting access.

Detection Guidance

Check Ghostfolio logs for unauthorized Premium subscription grants via Stripe callback URLs. Look for GET requests to /api/v1/subscription/stripe/callback with valid checkoutSessionId but no payment verification. Verify database entries for stripeCheckoutSessionId column uniqueness to detect duplicate redemptions.

Impact Analysis

An attacker could exploit this to obtain a Premium subscription for free, bypassing payment requirements. This could lead to unauthorized access to premium features, potential data exposure, or financial loss for the service provider.

Compliance Impact

This vulnerability allows unauthorized users to self-grant Premium subscriptions without payment, potentially leading to unauthorized access to sensitive financial or personal data. This could violate GDPR's data protection principles and HIPAA's access control requirements if user data is exposed or improperly accessed.

Mitigation Strategies

Upgrade Ghostfolio to version 3.4.0 or later to enforce payment_status and status checks. Review user accounts for unauthorized Premium subscriptions and revoke access. Monitor Stripe callback logs for suspicious activity. Ensure no custom callback handlers bypass the new validation logic.

Hi! I’m here to help you understand CVE-2026-47127. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70