https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T11:17:57.456786+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-59708 CVE-2026-59708 — Ghostfolio - Unauthorized Portfolio Data Exposure via Public Endpoint 2026-10-16T11:17:57.475515+00:00

Affected: ghostfolio

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings, quantities, buy prices, and performance metrics without authentication.