Which versions of Ghostfolio are affected by EUVD-2026-42074?

Ghostfolio's public API endpoint allows unauthenticated access to any user's complete investment portfolio data, including holdings, quantities, buy prices, and performance metrics, posing…

How to fix or mitigate EUVD-2026-42074?

Within 24 hours: Identify all Ghostfolio instances in production; review API audit logs for suspicious access to the GET /api/v1/public/:accessId/portfolio endpoint; notify affected users. Within 7 days: Implement API gateway authentication requirements or disable the public endpoint if not operationally necessary; enable API rate limiting and access logging. Within 30 days: Monitor Ghostfolio security advisories; apply vendor patch immediately upon release (version TBD pending vendor advisory).

Ghostfolio EUVD-2026-42074

Q: What is the CVSS score of EUVD-2026-42074?

EUVD-2026-42074 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-59708 HIGH

Missing Authorization (CWE-862)

2026-07-07 disclosure@vulncheck.com

GHSA-fqj2-r74g-4gfp

Authentication Bypass

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable endpoint requiring no login (PR:N) returns full portfolio data (C:H) with no integrity/availability impact; the non-guessable access-ID prerequisite is a practical, not base-metric, limiter.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 19:31 vuln.today

DescriptionCVE.org

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings, quantities, buy prices, and performance metrics without authentication.

AnalysisAI

Unauthorized portfolio data exposure in Ghostfolio's public API allows anyone holding a private access ID to read another user's full portfolio through the GET /api/v1/public/:accessId/portfolio endpoint. The endpoint accepts private access IDs without enforcing the granteeUserId filter, so holdings, quantities, buy prices, and performance metrics are returned without authentication. This is an authorization (broken access control) flaw with high confidentiality impact and no known public exploit at time of analysis.

Technical ContextAI

Ghostfolio is an open-source, self-hosted wealth and portfolio management application (NestJS/Angular) that lets users share portfolios via 'access' grants. Each grant is identified by an accessId and is intended to be scoped to a specific grantee via a granteeUserId association. The public endpoint GET /api/v1/public/:accessId/portfolio is designed to serve only public-type access grants, but the flaw is that it also resolves private access IDs and fails to validate that the requester matches the intended granteeUserId. This maps to CWE-862 (Missing Authorization): the authentication/authorization check that should restrict a private grant to its designated user is absent, so possession of the identifier alone yields the data.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change in commit 697ef59e3b58bebc5c21a9e482e4f5643390f316 (github.com/ghostfolio/ghostfolio/commit/697ef59e3b58bebc5c21a9e482e4f5643390f316) by upgrading to the tagged Ghostfolio release that includes it once available, tracking github.com/ghostfolio/ghostfolio/issues/7197 and the VulnCheck advisory for the exact version. As an interim compensating control, rotate/regenerate any private access IDs that may have been shared or exposed and revoke access grants that are no longer needed, since existing IDs remain valid until the code is patched; if feasible, restrict or block external access to the /api/v1/public/ path at a reverse proxy for deployments that do not rely on public sharing (trade-off: this disables legitimate public/shared portfolio links). Avoid exposing the Ghostfolio instance directly to the internet where portfolio sharing is not required.