CVE-2026-47127: Ghostfolio Auth Bypass Vulnerability

CVE-2026-47127 Overview

CVE-2026-47127 is a missing authorization vulnerability [CWE-862] in Ghostfolio, an open source wealth management application. The Stripe checkout success-URL handler at GET /api/v1/subscription/stripe/callback grants Premium subscriptions without verifying that the referenced Stripe Checkout Session was actually paid. Any authenticated user can craft a request that self-grants a one-year Premium subscription without payment. The flaw exists in all versions prior to 3.4.0.

Critical Impact
Authenticated attackers can bypass payment enforcement and grant themselves paid Premium subscriptions, causing direct revenue loss to Ghostfolio operators.

Affected Products

Ghostfolio open source wealth management software
All versions prior to 3.4.0
Self-hosted and managed Ghostfolio deployments with Stripe billing enabled

Discovery Timeline

2026-08-07 - CVE-2026-47127 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-47127

Vulnerability Analysis

Ghostfolio integrates Stripe Checkout for its Premium subscription flow. After a Stripe Checkout completes, Stripe redirects the browser to a success URL that includes the Checkout Session identifier. Ghostfolio's callback handler receives this identifier at GET /api/v1/subscription/stripe/callback?checkoutSessionId=<id> and uses it to activate a Premium subscription for the caller.

The handler retrieves the Stripe Checkout Session by ID and unconditionally grants a one-year Premium subscription to the account referenced by client_reference_id. It never inspects session.payment_status or session.status before granting entitlement. Ghostfolio also does not run a separate Stripe webhook endpoint with stripe-signature verification, so this callback is the only server-side code path that provisions Stripe-driven subscriptions.

An authenticated user can create an unpaid Stripe Checkout Session and immediately call the callback with that session ID. The server activates Premium without any payment ever settling. Impact is limited to the application's authorization model rather than confidentiality of user data.

Root Cause

The root cause is missing authorization enforcement in the Stripe callback [CWE-862]. The handler treats possession of a Checkout Session ID as proof of successful payment. It performs no state validation against Stripe's payment_status or status fields, and it does not enforce single-use redemption of a session identifier.

Attack Vector

Exploitation requires network access to the Ghostfolio API and a low-privileged authenticated account. The attacker generates an unpaid Stripe Checkout Session bound to their client_reference_id, then requests the callback URL with that session ID. The server issues a one-year Premium entitlement without cost. No user interaction from another party is required.

See the GitHub Security Advisory GHSA-j465-x2w3-wjj8 and the GitHub Pull Request #6872 for the patch details.

Detection Methods for CVE-2026-47127

Indicators of Compromise

Requests to GET /api/v1/subscription/stripe/callback from user accounts where no corresponding paid Stripe invoice or charge exists.
User records with an active Premium subscription but no matching paid Checkout Session or successful PaymentIntent in Stripe.
Repeated callback hits from the same account using different checkoutSessionId values within a short window.

Detection Strategies

Reconcile Ghostfolio subscription grants against Stripe API results, flagging any Premium activation whose Checkout Session has payment_status other than paid or status other than complete.
Alert on Premium subscription creations that lack a corresponding successful charge.succeeded or checkout.session.completed event with paid status in Stripe logs.
Review application logs for callback invocations that succeed without a preceding paid webhook or invoice record.

Monitoring Recommendations

Enable request logging on the subscription/stripe/callback endpoint and forward logs to a central analytics platform for correlation with Stripe events.
Track counts of Premium activations per user and per day to surface anomalous self-service upgrades.
Periodically export active Premium accounts and cross-check against Stripe's list of paid subscriptions.

How to Mitigate CVE-2026-47127

Immediate Actions Required

Upgrade Ghostfolio to version 3.4.0 or later, which enforces session.payment_status === 'paid' and session.status === 'complete' before granting entitlement.
Audit existing Premium subscriptions and revoke any grant that does not map to a paid Stripe Checkout Session or invoice.
Rotate any operational Stripe API keys if unauthorized session activity is suspected during the audit.

Patch Information

Ghostfolio 3.4.0 fixes the vulnerability by rejecting sessions unless session.payment_status === 'paid' and session.status === 'complete', failing closed on any other state. The release also adds a unique stripeCheckoutSessionId column so a Checkout Session cannot be redeemed twice, with the database unique constraint providing race-safe enforcement. Refer to the GitHub Pull Request #6872 for the exact code changes.

Workarounds

If immediate upgrade is not possible, restrict network access to the Ghostfolio API so that only trusted users can reach /api/v1/subscription/stripe/callback.
Temporarily disable the Stripe subscription flow in the Ghostfolio configuration until the patched version is deployed.
Add a reverse-proxy rule that blocks or logs all requests to the Stripe callback path for manual review.

bash

# Example: block the vulnerable callback path at an nginx reverse proxy
# until Ghostfolio 3.4.0 is deployed
location = /api/v1/subscription/stripe/callback {
    return 503;
}