VulnSocial

CVE-2026-47127Disclosure

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at `GET /api/v1/subscription/stripe/callback?checkoutSessionId=<id>` retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the session's `client_reference_id` — without ever checking `session.payment_status` or `session.status`. There is no separate Stripe webhook endpoint with `stripe-signature` verification; this callback is the sole code path that creates Stripe-driven subscriptions. Any authenticated user can self-grant a 1-year Premium subscription without ever paying. Version 3.4.0 rejects sessions unless `session.payment_status === 'paid'` AND `session.status === 'complete'` (fails closed). Additionally, new unique `stripeCheckoutSessionId` column → a session can't be redeemed twice (race-safe via DB unique constraint).

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-08-08); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-08-08: 1Mentions · 2026-08-09: 1Patch / Workaround · 2026-08-08: 1Patch / Workaround · 2026-08-09: 1Technical Details · 2026-08-08: 1Technical Details · 2026-08-09: 108-0808-09
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-08-081
Disclosure1
2026-08-091
Patch1
Full discourse2 posts
  • CyberSignal | Cybersecurity News@XQOPTRX
    Patch

    💳 Ghostfolio flaw allowed Premium subscriptions without payment CVE-2026-47127 affects Ghostfolio before 3.4.0. The Stripe callback failed to verify whether a Checkout Session was actually paid and completed before activating a Premium subscription. ✅ Fixed in 3.4.0. 🔎 Source: GitHub / CVE / VulDB #Ghostfolio #FinTech #AppSec #CVE #CyberSecurity

    Post summary

    The disclosure explains a vulnerability in Ghostfolio’s Stripe payment verification that allowed free premium subscriptions; it specifies the technical flaw and notes the patch in version 3.4.0.

    0000058
    34 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-47127 Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at `GET /api/v1/subscription/stripe/… https://www.cve.org/CVERecord?id=CVE-2026-47127

    Post summary

    CVE-2026-47127 affects Ghostfolio’s Stripe checkout success‑URL handler in versions before 3.4.0; the issue is disclosed with technical details indicating a version-based fix.

    000001.9K
    57.9K followersView on X

Explore more

Back to dashboard