PatchSiren cyber security CVE debrief
CVE-2026-59708 ghostfolio CVE debrief
CVE-2026-59708 is a high-severity vulnerability in Ghostfolio, a portfolio management tool. The vulnerability exists in the GET /api/v1/public/:accessId/portfolio endpoint, which accepts private access IDs without validating granteeUserId filtering. This allows unauthenticated attackers to retrieve sensitive portfolio information, including holdings, quantities, buy prices, and performance metrics. The vulnerability has a CVSS score of 8.7 and is classified as HIGH. Users of Ghostfolio, especially those with publicly accessible portfolios, should be aware of this vulnerability and take immediate action to protect their sensitive data.
- Vendor
- ghostfolio
- Product
- Unknown
- CVSS
- HIGH 8.7
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-07
- Original CVE updated
- 2026-07-07
- Advisory published
- 2026-07-07
- Advisory updated
- 2026-07-07
Who should care
Users of Ghostfolio, especially those with publicly accessible portfolios, should be aware of this vulnerability and take immediate action to protect their sensitive data. This includes reviewing and restricting access to sensitive portfolio data, implementing additional security measures such as authentication and authorization for API endpoints, and monitoring portfolio data for suspicious activity.
Technical summary
The vulnerability is caused by a lack of proper access control in the GET /api/v1/public/:accessId/portfolio endpoint. Specifically, the endpoint does not validate the granteeUserId when accepting private access IDs. This allows attackers to bypass authentication and retrieve sensitive portfolio information, including holdings, quantities, buy prices, and performance metrics. The vulnerability has a CVSS score of 8.7 and is classified as HIGH.
Defensive priority
High,Highly Confident,Publicly Accessible,Unauthenticated,Remote,High Impact,High Likelihood,CVSS 8.7,High Severity,High Urgency,High Exposure,High Confidence,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,Highly Impactful,Highly Urgent,Highly Exposed,Highly Confident,Highly Certain,Highly Likely,The
Recommended defensive actions
- Immediately update Ghostfolio to the latest version
- Review and restrict access to sensitive portfolio data
- Implement additional security measures, such as authentication and authorization, for API endpoints
- Monitor portfolio data for suspicious activity
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
- Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
- Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
Evidence notes
The CVE record was published on 2026-07-07T19:16:55.130Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The vulnerability exists in the GET /api/v1/public/:accessId/portfolio endpoint, which accepts private access IDs without validating granteeUserId filtering.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-07T19:16:55.130Z and has not been modified since then.