Beveiligingsadvies

CVE-2026-59708

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-07-07 18:38:50

Laatst bijgewerkt 2026-07-20 17:46:01

Toegewezen door VulnCheck

CVSS-score 8.7

Status PUBLISHED

Beschrijving

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings, quantities, buy prices, and performance metrics without authentication.

← Alle CVE's bekijken Bekijk op cve.org ↗