CVE-2026-59709
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint in Ghostfolio fails to verify the Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting portfolio categorization and reports.
Risk Assessment
The risk involves unauthorized modification of portfolio data by an attacker with read-only access, potentially leading to incorrect asset categorization and false reports, impacting investment decisions and system integrity.
Recommendation
Immediately update Ghostfolio to a version that fixes the permission verification in the PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint, and review all active read-only access tokens for potential abuse.
Other vulnerabilities in Ghostfolio
See all- CVE-2026-47127Medium
Ghostfolio, an open source wealth management software, prior to version 3.4.0 has a vulnerability in the Stripe checkout success-URL handler that grants a Premium subscription without checking payment status. Any authenticated user can self-grant a 1-year Premium subscription without paying. Fixed in version 3.4.0.
- CVE-2026-59708High
The GET /api/v1/public/:accessId/portfolio endpoint in Ghostfolio does not validate granteeUserId filtering, allowing unauthenticated attackers to retrieve full portfolio data using a private access ID.
Original NVD description (English source)
Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting portfolio categorization and reports.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS