THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-59708 (HIGH 7.5) — The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information includi

[NVD] CVE-2026-59708 (HIGH 7.5) — The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information includi

lownvdPublished 2026-07-07

CVE-2026-59708 CVSS: 7.5 HIGH Published: 2026-07-07T19:16:55.130

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings, quantities, buy prices, and performance m

Indicators of compromise

CVE-2026-59708cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-59708