CVE-2026-47127: Ghostfolio has a Stripe subscription bypass
Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at GET /api/v1/subscription/stripe/callback?checkoutSessionId=<id> retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the session's clientreferenceid — without ever checking session.paymentstatus or session.status. There is no separate Stripe webhook endpoint with stripe-signature verification; this callback is the sole code path that creates Stripe-driven subscriptions. Any authenticated user can self-grant a 1-year Premium subscription without ever paying. Version 3.4.0 rejects sessions unless session.paymentstatus === 'paid' AND session.status === 'complete' (fails closed). Additionally, new unique stripeCheckoutSessionId column → a session can't be redeemed twice (race-safe via DB unique constraint).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghostfolioto a version that resolves this vulnerability.Fixed in 3.4.0 - Configuration
Update the callback handler logic so it grants a Premium subscription only after retrieving the Stripe Checkout Session by checkoutSessionId and verifying both conditions: session.payment_status === 'paid' and session.status === 'complete' (reject/deny otherwise, fail closed).
Ghostfolio Stripe checkout success URL handler (GET /api/v1/subscription/stripe/callback) session payment/status checks = session.payment_status === 'paid' AND session.status === 'complete'
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47127?
The severity of CVE-2026-47127 is medium with a CVSS score of 6.5.
How does CVE-2026-47127 affect Ghostfolio users?
CVE-2026-47127 allows unauthorized users to gain a Premium subscription without proper authentication.
Which versions of Ghostfolio are affected by CVE-2026-47127?
CVE-2026-47127 affects Ghostfolio versions prior to 3.4.0.
How can I fix CVE-2026-47127?
To fix CVE-2026-47127, upgrade to Ghostfolio version 3.4.0 or later.
Is there a workaround for CVE-2026-47127?
There are no recommended workarounds for CVE-2026-47127 other than updating to the fixed version.