{"id":"CVE-2026-47127","title":"Ghostfolio is an open source wealth management software","summary":"Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at `GET /api/v1/subscription/stripe/callback?checkoutSessionId=<id>` retrieves the Stripe Checkout Session …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-862"],"published":"2026-08-07","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:55:04.493","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47127","references":[{"url":"https://github.com/ghostfolio/ghostfolio/pull/6872","label":"security-advisories@github.com"},{"url":"https://github.com/ghostfolio/ghostfolio/security/advisories/GHSA-j465-x2w3-wjj8","label":"security-advisories@github.com"},{"url":"https://github.com/ghostfolio/ghostfolio/security/advisories/GHSA-j465-x2w3-wjj8","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00338,"epssPercentile":0.24492,"ingestedAt":"2026-09-09T21:22:45.525Z","slug":"CVE-2026-47127","body":"## Overview\n\nGhostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at `GET /api/v1/subscription/stripe/callback?checkoutSessionId=<id>` retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the session's `client_reference_id` — without ever checking `session.payment_status` or `session.status`. There is no separate Stripe webhook endpoint with `stripe-signature` verification; this callback is the sole code path that creates Stripe-driven subscriptions. Any authenticated user can self-grant a 1-year Premium subscription without ever paying. Version 3.4.0 rejects sessions unless `session.payment_status === 'paid'` AND `session.status === 'complete'` (fails closed). Additionally, new unique `stripeCheckoutSessionId` column → a session can't be redeemed twice (race-safe via DB unique constraint).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}