The GET /api/v1/public/:accessId/portfolio endpoint in Ghostfolio accepts private access identifiers without validating the granteeUserId, creating a Missing Authorization flaw (CWE‑862). As a result, users who obtain any private access ID can retrieve the entire contents of the associated portfolio—holdings, quantities, purchase prices, and performance metrics—without authenticating at all. This vulnerability directly compromises the confidentiality of user investment information.

This flaw affects installations of the Ghostfolio application that expose the /api/v1/public/:accessId/portfolio endpoint. Any deployment of the Ghostfolio product that has not applied protective changes to enforce granteeUserId filtering is vulnerable; version details are not specified in the advisory, implying that all current builds are potentially affected.

The issue carries a CVSS score of 8.7, indicating a high severity level. The EPSS score is listed as < 1%, meaning that, while exploitation probability is currently very low, it is not zero, and the vulnerability is not currently in CISA’s KEV catalog. An attacker must first acquire a valid private access ID, a step not described in the advisory; once the ID is known the endpoint can be queried from any location to extract the portfolio data.