CyberRota Analysis
AI-GeneratedThe vulnerability exists in the GET /api/v1/public/:accessId/portfolio endpoint of Ghostfolio, which improperly accepts private access IDs without validating the associated user ID. This flaw allows unauthenticated attackers to access sensitive portfolio information, including holdings and performance metrics, potentially leading to data breaches. Organizations using Ghostfolio should prioritize addressing this issue to protect sensitive financial data from unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings, quantities, buy prices, and performance metrics without authentication.