Unvalidated Subscription Grant in Ghostfolio Wealth Management Software

CVE-2026-47127

What is CVE-2026-47127?

Ghostfolio, an open-source wealth management software, contains a vulnerability where its Stripe checkout success-URL handler allows any authenticated user to obtain a Premium subscription without payment. This occurs when the system retrieves the Stripe Checkout Session by ID and grants subscriptions based purely on the client_reference_id, ignoring critical status checks such as payment_status and session.status. The vulnerability is exacerbated by the absence of a secure webhook endpoint that verifies stripe-signature, relying instead solely on this callback for creating subscriptions. In version 3.4.0, this issue is mitigated by requiring both a paid payment status and a complete session status, alongside the introduction of a unique session ID column to prevent exploitation through session reuse.

References