Report

Should I Use Ghostfolio?

ghostfol.io·Analyzed 17 hours ago·9/19/2026·Based on 10 sources

Open source wealth management dashboard tracking net worth across cash, stocks, ETFs and cryptocurrencies.

Depends

Depends

Buy if you're a privacy-minded self-hoster comfortable running, updating, and patching your own server.

Free, privacy-first self-hosted net-worth tracker — great for DIYers, wrong if you won't run and patch a server.

Confidence: Medium

Yes

Free tier

Self-hosted, AGPL-3.0

456 points

Hacker News launch

Aug 2023 thread

3

CVEs in sources

Incl. auth bypass pre-v3.4

Value for money

5

Free open source; self-host costs nothing

Ease of use

3

Self-host setup; chart complaints reported

Feature depth

3

Multi-asset tracking; corporate-action gaps questioned

Support quality

2

Community-only support found; no SLA

Security posture

2

Auth bypass CVE pre-v3.4; two more CVEs

Pros

Privacy-first, open source dashboard for net worth^¹
Tracks cash, stocks, ETFs, crypto across multiple platforms^¹
Free to self-host under AGPL-3.0^²
Community-built broker syncs, e.g. Trading 212 tool^⁸
Strong community buzz: 456-point Hacker News thread^⁶

Cons

Auth bypass vulnerability affects all versions before 3.4^³
Free path requires self-hosting and maintenance
Stock-split and dividend handling questioned by users^⁶
Price-chart accuracy complaints in self-hosted tracker threads^⁷

Gotchas

highPatch immediately: auth bypass affects all versions prior to 3.4^³
mediumTwo additional CVEs appear in databases, one medium (CVSS 4.3)^⁴
mediumVerify splits, consolidations, dividend handling before importing history^⁶
mediumBroker sync tools like Trading 212 are unofficial and may break^⁸

Best for

Self-hosters and privacy purists
Multi-broker DIY investors
Spreadsheet refugees automating net worth
Open-source enthusiasts avoiding paid trackers

Not for

Anyone unwilling to run and patch a server
Hands-off investors wanting plug-and-play broker sync
Firms and advisors — it's personal, not professional, software
Users who won't track CVEs on their own deployment

Pricing

Self-hosted

Free

Full dashboard
AGPL-3.0 open source
You host, update, and secure it

Security

Multiple CVEs in reviewed sources, including an auth bypass fixed in v3.4 — patch before trusting it with financial data.

CVE-2026-47127: Auth bypassAffects all Ghostfolio versions prior to 3.4^³
CVE-2026-59709Medium severity, CVSS 4.3^⁴
CVE-2026-59708Listed in vulnerability databases; details thin in reviewed sources^⁵

What users say

Self-hosters on Reddit and Hacker News like consolidating multi-broker net worth but question chart accuracy and corporate-action handling.

“I'm trying to consolidate all my investment tracking into a single dashboard instead of juggling spreadsh…”

— Reddit, r/selfhosted

“Does it handle stock splits, consolidations, dividends etc?”

— Hacker News

“I built a Trading 212 -> Ghostfolio sync tool for auto portfolio tracking”

— Reddit, r/homelab

Alternatives

Compare Ghostfolio with each alternative.

Firefly III

Self-hosted alternative weighted toward budgeting and expenses

Ghostfolio vs Firefly III

Actual Budget

Open-source budgeting-first option, often compared head-to-head

Ghostfolio vs Actual Budget

Plain spreadsheet

Zero setup for a small, simple portfolio

Hosted net-worth dashboards

Guess: paid hosted trackers if you refuse to self-host

Ghostfolio vs Hosted net-worth dashboards

Full analysis

Based on 15 public sources; no numeric review ratings or vendor pricing pages found.

Sources

Ghostfolio – Official siteghostfol.io
official
Ghostfolio on GitHubgithub.com
official
CVE-2026-47127: Ghostfolio Auth Bypasssentinelone.com
security
CVE-2026-59709: Medium, CVSS 4.3echelongraph.io
security
CVE-2026-59708cve.imfht.com
security
Hacker News launch threadnews.ycombinator.com
news
Self-hosted portfolio tracker discussionreddit.com
review
Trading 212 sync toolreddit.com
review
Actual vs Ghostfolio comparisonlibhunt.com
review
Start9 community: Ghostfolio vs Firefly IIIcommunity.start9.com
review

Rate this review

Anonymous. You can change your vote.

Loading votes…

Ask a follow-up

Ask if a use case fits. Answers stay inside this report and its sources.

Comments

One queue. No replies. Give a display name first. Limit: 7 comments per day.

No comments yet.

Depends

Buy if you're a privacy-minded self-hoster comfortable running, updating, and patching your own server.

Who it's for

Self-hosters and privacy purists
Multi-broker DIY investors
Spreadsheet refugees automating net worth
Open-source enthusiasts avoiding paid trackers

Who it's not for

Anyone unwilling to run and patch a server
Hands-off investors wanting plug-and-play broker sync
Firms and advisors — it's personal, not professional, software
Users who won't track CVEs on their own deployment

Gotchas

Patch immediately: auth bypass affects all versions prior to 3.4³
Two additional CVEs appear in databases, one medium (CVSS 4.3)⁴
Verify splits, consolidations, dividend handling before importing history⁶
Broker sync tools like Trading 212 are unofficial and may break⁸

Pricing notes

Self-hosted: Free — Full dashboard; AGPL-3.0 open source; You host, update, and secure it

Key capabilities

Yes — Free tier (Self-hosted, AGPL-3.0)
456 points — Hacker News launch (Aug 2023 thread)
3 — CVEs in sources (Incl. auth bypass pre-v3.4)
Value for money: 5/5. Free open source; self-host costs nothing
Ease of use: 3/5. Self-host setup; chart complaints reported
Feature depth: 3/5. Multi-asset tracking; corporate-action gaps questioned
Support quality: 2/5. Community-only support found; no SLA
Security posture: 2/5. Auth bypass CVE pre-v3.4; two more CVEs

Security notes

Multiple CVEs in reviewed sources, including an auth bypass fixed in v3.4 — patch before trusting it with financial data.

CVE-2026-47127: Auth bypass. Affects all Ghostfolio versions prior to 3.4³
CVE-2026-59709. Medium severity, CVSS 4.3⁴
CVE-2026-59708. Listed in vulnerability databases; details thin in reviewed sources⁵

What to use instead

Firefly III — Self-hosted alternative weighted toward budgeting and expenses https://www.firefly-iii.org/
Actual Budget — Open-source budgeting-first option, often compared head-to-head https://www.libhunt.com/compare-actual-vs-ghostfolio
Plain spreadsheet — Zero setup for a small, simple portfolio https://docs.google.com/spreadsheets
Hosted net-worth dashboards — Guess: paid hosted trackers if you refuse to self-host https://ghostfol.io/en/resources/personal-finance-tools/open-source-alternative-to-walletguide

Sources

1.Ghostfolio – Official site https://ghostfol.io/en/
2.Ghostfolio on GitHub https://github.com/ghostfolio/ghostfolio
3.CVE-2026-47127: Ghostfolio Auth Bypass https://www.sentinelone.com/vulnerability-database/cve-2026-47127/
4.CVE-2026-59709: Medium, CVSS 4.3 https://echelongraph.io/pulse/CVE-2026-59709
5.CVE-2026-59708 https://cve.imfht.com/detail/CVE-2026-59708?lang=en
6.Hacker News launch thread https://news.ycombinator.com/item?id=37337482
7.Self-hosted portfolio tracker discussion https://www.reddit.com/r/selfhosted/comments/1et3umd/selfhosted_portfolioinvestment_tracker/
8.Trading 212 sync tool https://www.reddit.com/r/homelab/comments/1shfd0e/i_built_a_trading_212_ghostfolio_sync_tool_for/
9.Actual vs Ghostfolio comparison https://www.libhunt.com/compare-actual-vs-ghostfolio
10.Start9 community: Ghostfolio vs Firefly III https://community.start9.com