CVE-2026-47127

Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at GET /api/v1/subscription/stripe/callback?checkoutSessionId= retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the session's client_reference_id — without ever checking session.payment_status or session.status. There is no separate Stripe webhook endpoint with stripe-signature verification; this callback is the sole code path that creates Stripe-driven subscriptions. Any authenticated user can self-grant a 1-year Premium subscription without ever paying. Version 3.4.0 rejects sessions unless session.payment_status === 'paid' AND session.status === 'complete' (fails closed). Additionally, new unique stripeCheckoutSessionId column → a session can't be redeemed twice (race-safe via DB unique constraint).