Ghostfolio versions earlier than 3.4.0 allow authenticated users to receive a full‑year Premium subscription by accessing a Stripe callback URL that skips validation of the session’s payment status and completion state. The flaw is a classic authorization bypass (CWE‑862) that lets an attacker elevate privileges by claiming paid access without actually completing the payment process.

The vulnerability affects the open‑source Ghostfolio wealth‑management application before release 3.4.0. Users running any Ghostfolio version older than 3.4.0 are at risk if the /api/v1/subscription/stripe/callback endpoint is reachable and unprotected.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. If an attacker can obtain or guess a valid Stripe checkout session ID, they can trigger the callback with an authenticated session and obtain a Premium subscription without payment. The exploit requires authentication to the Ghostfolio instance and is performed via an unauthenticated HTTP GET to the callback endpoint—a likely attack vector inferred from the description.